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ABSTRACT 
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perfonnance objectives and quantifiable characterization of the hazardous elements 
comprising the threat scenarios are essential to evaluating outcomes using a performance- 
based design approach. 

A mixed methods research approach is used to analyze the Physical Security 
Criteria for Federal Facilities standard to make policy recommendations that may 
enhance occupant safety and federal property protection from arson attacks. 
Computerized fire effects modeling is used to compare outcomes in non-military and 
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I. INTRODUCTION 


The federal government is the largest real property manager in the United States. 
Overall, it owns or leases more than 3.34 billion square feet (3.10296 x 10‘ m ) of property 
among 429,000 buildings used by 24 government agencies 3 (U.S. General Services 
Administration, 2010b). To provide tenants, workers, residents, and visitors a degree of 
protection from threats to their health, safety, and welfare while they occupy these 
structures, these buildings are required by federal law to meet minimum construction 
standards. 

In the United States, federal building design and construction for the last 50 years 
were based on prescriptive standards. While these regulations generally have served well 
in protecting occupants and buildings, the changing nature of adversaries and their tactics 
demands a new approach to federal asset protection. In 1995, the federal government 
began a transition to risk-based security planning and decision making to protect public 
buildings. That transition can be enhanced to meet dynamic threats by embracing the 
precepts of perfonnance-based design. 

A. PROBLEM STATEMENT 

Most contemporary U.S. building designs are prescriptive, in that they must 
comply with specific safety rules and features prescribed within building codes. Although 
codes do not specify how buildings are designed, they limit architectural options. 
Designers must comply with a stringent framework of regulations that do not address 
specific threats nor provide predictable or measurable outcomes in response to specific 
threats or vulnerabilities. Why are prescriptive designs a problem? They offer generic 
solutions that may not adequately address the overall threats, vulnerabilities, risks, and 
hazards needed to create a resilient facility. 


3 This study is limited to the approximately 9,000 non-military, non-postal buildings controlled by the 
General Services Administration. 
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Following the April 20, 1995, domestic terrorist bombing of the Alfred P. Murrah 
Building in Oklahoma City, the U.S. Department of Justice was tasked to assess the 
vulnerability of federal office facilities to terrorism and acts of violence. A series of 
subsequent federal efforts have developed a risk-based model to assess and improve 
facility security. The Physical Security Criteria for Federal Facilities (2010) employs a 
risk-based approach to assign permanent countermeasures to a variety of pre-scripted 
adversarial and terrorist threat scenarios. Once the security threat level is established 
through a ranking protocol, the risk-based model directs the tenant Facility Security 
Committee (FSC) to select permanent countermeasures from a table of prescriptive 
options intended to minimize risk, or the FSC may simply accept the risk. The mix of 
perfonnance-based risk assessment and prescriptive solutions is irrational. 

Risk includes the probability of an event and its impact. To evaluate risk 
adequately, threats, vulnerabilities, and consequences must be quantified. The 
Interagency Security Committee (ISC) Design-Basis Threat (DBT) and Physical Security 
Criteria for Federal Facilities standards are policy documents that describe 31 different 
terrorist scenarios and provide limited design options to address each one. In a few cases, 
the asymmetric threat scenarios are clearly articulated and quantified so a physical 
security specialist could develop meaningful countermeasures. For example, the scenario 
for a mailed or delivered explosive device states the device likely will “be packaged in a 
large, padded shipping enveloped or small box containing not less than 100 grams of 
TNT 4 or TNT equivalent” (U.S. Department of Homeland Security, 2010c). Knowing the 
size of the explosive component, a physical security specialist can assess the impact of 
the shock wave, its travel distance, its velocity, and the likelihood of death, injury, and 
damage within a certain radius of the device. 


4 Tri-nitro-toluene, a common high explosive. 
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The Physical Security Criteria for Federal Facilities ’ pre-scripted threat scenarios 
include this one for arson: 5 “An adversary places an improvised incendiary device (IID) 
containing an accelerant and utilizing a delay mechanism adjacent to a facility, but 
outside the view of security countermeasures.” While this covert threat may sound 
dramatic, it is ill defined and not measurable. The size of the device, the physical and 
chemical nature of the accelerant, the volume or weight of the accelerant, the distance 
from the facility, and the facility type of construction are not defined; therefore, a 
meaningful risk assessment cannot be performed and suitable pennanent 
countenneasures cannot be identified and applied. A performance-based design method 
would allow the security team to define a range of threats, assess their potential effects, 
and evaluate specific countenneasures most suited to address them. 

Arson is a security and tenorist threat to federal buildings and facilities in the 
United States. According to Baird (2006), “historical analysis of incidents coupled with 
open source information reveals that tenorist groups in general are adapting toward 
simple destructive methods like arson with increasingly high levels of fatalities” (p. 416). 
As recently as May 31, 2012, the Department of Homeland Security National Operations 
Center issued a warning that: 

International terrorist groups and violent extremists have long shown 
interest in using fire as a weapon due to the low cost and limited technical 
expertise required, the potential for causing large-scale damage, and the 
low risk of apprehension. Recent encouragement of use of this tactic by 
terrorist groups and violent extremists in propaganda materials and 
extremist web forums is directed at Western audiences and supports 
Homeland attacks. (U.S. Department of Homeland Security Office of 
Intelligence and Analysis, 2012, p. 2) 

On February 14, 2012, a homeland security fusion center reported intelligence 
that an alleged member of an Iraqi terrorist organization was plotting to burn Federal 
Emergency Management Agency buildings throughout the United States (Maryland 


5 Arson is a common law term that describes the crime of using fire to injure persons or damage 
property. In the fire protection field, “incendiarism” defines the act of intentional fire setting regardless of 
criminal intent. Since the ISC uses the term arson to describe intentionally set fires, it is used 
synonymously with incendiarism in this thesis. 
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Coordination and Analysis Center, 2012). Overall, arson in the United States accounted 
for an estimated 210,300 intentionally set fires each year from 2004 to 2006, the most 
recent years for which data is available. Intentionally set fires accounted for 13% of fires 
reported by fire departments in the United States. These fires resulted in an average of 
approximately 375 deaths, 1,300 injuries, and $1.06 billion in property loss each year 
(U.S. Fire Administration, 2009). In non-military and non-postal federally owned or 
leased properties alone, from 2008 to 2010, 51 structural fires caused $10,647,586 in 
damage. More than 5% of these fires were attributed to arson or domestic terrorist attack 
(J. Elvove, personal communication. May 10, 2011). Table 1 provides a summary of the 
fire incident data reported to the General Services Administration (GSA) in non-military 
and non-postal federal facilities 6 during that period. 


Table 1. Fire Incidents: GSA Federal Facilities: 2008-2010 (From: J. Elvove, 

personal communication. May 10, 2011) 


Property type 

2010 

Year 

2009 

2008 

Total 

% Total 

Office 

14 

14 

16 

44 

80.0 

Courthouse 

0 

1 

5 

6 

10.9 

Retail space 

0 

0 

1 

1 

1.8 

Mobile 3 

1 

2 

1 

4 

7.3 

Total 

15 

17 

23 

55 

100.0 


a Mobile properties include mobile equipment: movable under its own power, or 
towed, such as an airplane, automobile, boat, cargo trailer, farm vehicle, motorcycle, 
or recreational vehicle, and are outside the scope of this study. 


The predominant cause of fires in these facilities was some sort of electrical 
problem: faulty wiring, poor maintenance, or improperly used equipment. Table 2 
provides a breakdown by ignition source of the structural fires reported to the GSA 
during the 2008-2010 period. 


6 The Administrator of GSA is responsible for the construction and maintenance of non-military and 
non-postal federal facilities. See 40 U.S.C. § 3302 (2010) and 40 U.S.C. § 581 (2010). 


4 



Table 2. Fire Causes: GSA Federal Facilities: 2008-2010 (From: J. Elvove, personal 

communication, May 10, 2011) 


Ignition source 

2010 

Year 

2009 

2008 

Total 

% Total 

Arson/incendiary 

0 

1 

1 

2 

3.6 

Cooking 

0 

0 

4 

4 

7.3 

Electrical lighting/equipment 

12 

11 

13 

36 

65.5 

Welding/cutting 

1 

1 

2 

4 

7.3 

Domestic terror attack 3 

1 

0 

0 

1 

1.8 

Other 

1 

4 

3 

8 

14.5 

Total 

15 

17 

23 

55 

100.0 


Note. Data includes mobile properties. 

J Private airplane flown into office building, Austin, Texas, February 18, 2010. 


Despite the fact the data overwhelmingly shows that in the 2008-2010 timeframe 
the leading cause of fire in non-military, non-postal federal buildings was some sort of 
electrical malfunction, concern exists regarding malicious acts against federal properties. 
According to the ISC DBT, the baseline threat to federal facilities from the described IID 
event is assessed to be high (U.S. Department of Homeland Security, 2010c). 

For the purpose of this study, no distinction occurs between the use of the terms 
fire and arson. Fire is a complex chemical reaction generally involving a fuel, an 
oxidizing agent, and a competent heat source, and arson is a legal term to describe a 
criminal act—the consequence of which is a fire or explosion. Fires may occur as the 
result of a natural event, such as a lightning strike in light grassy fuels, or as the 
unintentional result of a mechanical malfunction, such as overheating equipment or an 
electrical spark. Likewise, fires can result from human error, such as discarding burning 
debris or by misusing of flammable products around heat sources. The outcome of 
unintentional fires or those intentionally set may be the same: unwanted heat, smoke, 
property damage, injury, or death. 

While improvised explosive devices (IED) often are the primary focus of federal 
security professionals trying to protect assets from a terrorist attack, a direct link does 
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exist between IED and fire. The instantaneous oxidation that occurs when an IED 
explodes is the same chemical reaction that occurs in a fire; only the speed with which 
the chemical reaction and ensuing shock wave occur are different. Furthermore, the 
instantaneous oxidation of an IED may be the trigger for a secondary, firebomb-type 
device. The car bomb parked May 2, 2010 by Faisal Shahzad in New York City’s Times 
Square contained 10 gallons (37.8 L) of gasoline and three 25-pound (23.6 L) liquefied 
petroleum gas cylinders. According to Williams and Dienst (2010), while a test 
conducted by the Federal Bureau of Investigation’s (FBI) Operational Technology 
Division could not calculate the firebomb’s exact explosive force, its effects likely would 
have killed scores of people. 

A second shortcoming of the Physical Security Criteria for Federal Facilities 
approach is its emphasis on threats it calls “primarily manmade.” According to the report, 
“other threats to buildings, such as earthquakes, fire, or storms are beyond the scope of 
this document and are addressed in applicable construction standards [italics added], 
although many of the countenneasures identified will contribute to mitigating natural 
hazards” (U.S. Department of Homeland Security, 2010c). This approach presumes the 
applicable construction standards—the model building codes—are adequate to protect 
against these and other natural hazards. Many technological hazards—such as fires, gas 
leaks, and other hazardous materials releases—are both manmade and an equal or greater 
threat than terrorist attacks. To provide comprehensive physical security for federal 
facilities, all hazards and threats should be addressed by the nature of the destructive 
potential. 

B. RESEARCH QUESTIONS 

1. Primary Research Question 

How can the U.S. Department of Homeland Security (DHS) ISC Physical 
Security Criteria for Federal Facilities standard employ performance-based design 
methods to evaluate the effectiveness of its pennanent countenneasure options to arson 
threats? 
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2. Secondary Research Questions 


How can the arson threat scenario described in the DBT be quantified for the 
purposes of selecting permanent countenneasures? 

Are the design methods published in the Society of Fire Protection Engineers 
(SFPE) SFPE Engineering Guide to Performance Based Fire Protection or the 
International Code Council (ICC) Performance Code for Buildings and Facilities suitable 
tools to evaluate pennanent countermeasure options to quantified arson threats? 

Should the ISC reports Physical Security Criteria for Federal Facilities and the 
DBT be limited to criminal or manmade threats as stated in the documents? 

C. HYPOTHESIS 

DHS ISC was created to produce physical security standards for non-military and 
non-postal federal facilities. It has developed a risk-based analytical approach to assess 
the protection of federal employees and property from manmade threats. The approach is 
intended to give in situ FSC members a means to evaluate the level of protection needed 
based on an assessment of the facility’s overall vulnerability to one or more threats. 
While the risk-based approach employs an easy-to-follow process, some threat scenarios 
do not provide enough infonnation to permit a rational evaluation of the outcome. 

The ISC DBT and Physical Security Criteria for Federal Facilities standards are 
policy documents that describe a condensed description of 31 different threat scenarios 
and provide limited design solutions to address each one. In some cases, the threat 
scenarios are clearly articulated and quantified so a physical security specialist could 
develop meaningful countenneasures. In the arson scenario, the description is so vague 
that threat-specific countermeasures cannot be developed. 

Arson as a means of attack on federal facilities remains a vulnerability that should 
be addressed in federal construction practices to minimize hazards to occupants’ lives, 
damage to taxpayer-owned property, and the interruption of essential government 
services. Current building and fire codes are predicated on a single fire event that occurs 
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in or near a structure, and built-in fire protection features are expected to control the fire 
to a reasonable degree. An arsonist armed with large quantities of highly flammable 
materials—or one who manages to set multiple fires within or near a structure—creates 
events not anticipated in contemporary codes and construction methods. Specific 
countermeasures—based on the anticipated threat—are needed to provide successful 
event outcomes as defined by those affected. 

In its assessment of the arson threat, the DBT cites Federal Bureau of 
Investigation Uniform Crime Reporting data and DHS’ Federal Protective Service (FPS) 
records that indicate from 2007 through 2010, nine arson cases were reported at 
approximately 9,000 GSA properties. 7 While the scale and history have not been 
significant, the DBT acknowledges the arson threat to federal facilities is viable. 

Based on the unsophisticated nature of the attack, availability of specific 
information on planning and executing such an attack, the historical 
frequency of its use in general and specifically against Federal facilities, 
and demonstrated intent by terrorist organizations to utilize this tactic 
against Federal facilities, the baseline threat to Federal facilities is 
assessed to be HIGH [emphasis in original text], (U.S. Department of 
Homeland Security, 2010c) 

Terrorist and adversarial threats are dynamic; perpetrators probe to find 
weaknesses in security plans and countermeasures. Threats and tactics change over time. 
Improvised weaponry evolves over time and becomes more sophisticated and harder to 
detect. Even technological hazards—dismissed in the Physical Security Criteria for 
Federal Facilities as beyond the scope of the document—change with growth in 
technology, industry, and markets. Using design-basis threat scenarios that lead to a 
limited number of permanent countermeasure options is shortsighted and contrary to 
meaningful security. If the Physical Security Criteria for Federal Facilities standard and 
its supporting DBT were amended to employ performance-based design methods using 
quantified arson threats, then threat-specific permanent countenneasures could be defined 
to mitigate the consequences. 


7 Chapter VII addresses vagaries in data collection and reporting. 
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An analysis of these two ISC policies will reveal that their current design-basis 
and permanent countermeasure strategies do not provide facility security, architecture, or 
design teams meaningful criteria against which a proposed design can be measured. The 
policies are lacking fundamental criteria to explain the differences among arson attack 
methods, the nature of the potential weaponry, the potential for damage, and the 
effectiveness of the countermeasures included as design options in the standards that 
should be employed. 

As a result of the policy analysis, it is anticipated that recommendations will be 
made to adopt one or more elements of the perfonnance-based design methods of the 
SFPE or ICC used to address specific fire problems that start with the quantification of 
the potential fire threat and developing scientific and engineering-based design solutions 
to control or mitigate the event. The analysis may reveal that perfonnance-based design 
methods could be applied to the other 30 threat scenarios described in the DBT. 

The opportunity exists from this research to influence the application of a policy 
that addresses threat quantification among all the 31 design scenarios. Each of the 
scenarios could provide measurable parameters that would allow physical security 
specialists to assess the threat fully. 

D. METHOD 

The development of federal administrative policies is a complex process 
involving many—and sometimes competing—interests. The creation of the Physical 
Security Criteria for Federal Facilities standard was the work of participants from more 
than 20 agencies representing law enforcement, building construction and management, 
security, diplomacy, intelligence, education, human health, finance, and environmental 
protection. Given the range of professional disciplines involved, traditional quantitative 
or qualitative research methods may not fully address the breadth, complexity, and 
synergy of this effort. To get a more complete picture to perform better policy analysis, a 
variety of research methods are desirable. 
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Bardach (2009) described the evolving nature of policy analysis where the 
traditional image of the policy wonk buried deep in a bureaucracy producing periodic and 
detailed reports for decision makers has been replaced by policy analysts who work in 
cross-agency teams in loose networks that cut across organizational lines, which is 
precisely how the Physical Security Criteria for Federal Facilities standard was 
developed. 

An evolving research method is applicable to evaluate this multi-discipline 
product, which is mixed methods research. Johnson and Onwuegbuzie (2004) defined 
mixed methods research as “the class of research where the researcher mixes or combines 
quantitative and qualitative research techniques, methods, approaches, concepts or 
language into a single study” (p. 17). They further stated that the goal of mixed methods 
research is not to replace either quantitative or qualitative research approaches, but to 
“draw from the strengths and minimize the weaknesses of both in single research studies 
and across studies” (pp. 14-15). Greene, Caracelli, and Graham (1989) reported that one 
of the five primary reasons for employing mixed methods research was triangulation, 
which is the comparison of findings from different methods to interpret the phenomenon 
under study. 

The policy outcome to address these aforementioned shortcomings of prescriptive 
design solutions may be to adopt and apply the methods of performance-based design for 
fire safety. Perfonnance-based design employs a rigorous multi-step system that 
articulates the desired perfonnance end-state (the anticipated level of protection from the 
threat), and, using scientific and engineering tools, offers design options to achieve it. 
Performance-based design methods also embrace stakeholder accountability from 
programmatic concept, through design and construction, to implementation, and 
ultimately, to on-going maintenance. Stakeholders, both the Federal Security Committee 
and tenants, play a key role in defining and solving the desired end-state. 

The policy analysis approach was selected to dissect and evaluate the existing 
policy (the Physical Security Criteria for Federal Facilities standard and its supporting 
DBT with the intent of identifying potential shortcomings and improvements during the 
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validation period. Policy analysis is expected to explore several ISC self-acknowledged 
shortcomings, as well as weaknesses in the use of the arson design basis threat currently 
specified in the document. Policy analysis will compare the methods described in the two 
documents to methods employed in the developing field of perfonnance-based design. 

The policy analysis approach will examine a number of the assumptions that 
underlie the problem statement. The most important consideration is that without clearly 
articulated design parameters, a desired end-state (level of protection) cannot be 
identified, nor its risk measured. Importing a poorly defined threat into a risk analysis 
model prevents its users from developing measurable outcomes. 

To supplement the analysis, two prototypical facility scenarios are created 
representing federal facility configurations, and the designs are subjected to simulated 
fires using state-of-the-art fire modeling software. The model results are compared and 
evaluated for performance with the expectation that the current DBT arson scenario is 
unsatisfactory to achieve meaningful permanent countermeasures. 

E. RESEARCH SIGNIFICANCE 

This thesis serves to fill a gap in the literature pertaining to the application of 
perfonnance-based design for federal facilities, with the potential for transfer to other 
government and private sector real property. Much of the literature on performance-based 
design is anticipatory as to how performance-based design approaches might be used, but 
the United States still has minimal experience with the method as a means of building 
design, construction, and performance evaluation. 

Furthermore, this thesis serves as a foundation for additional research in the 
application of performance-based design to terrorist and criminal threats other than arson, 
a number of which are articulated in the DBT. By being able to quantify the scale, scope, 
and potential outcomes of various threat(s), the design and engineering community can 
strive to develop measurable protective strategies and designs to mitigate the threat and 
consequences. 
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The changing nature of terrorist tactics and threats—as well as those dismissed as 
manmade—requires a robust method that can evaluate the efficacy of proposed 
countenneasures for facility safety before they are implemented at sometimes significant 
costs to taxpayers. As such, this thesis may be useful to the DHS ISC, the GSA and other 
federal agencies that acquire, construct, or substantially remodel real property. 

F. CHAPTER OVERVIEW 

Following this introduction, Chapter II reviews recent literature pertaining to 
federal facility protection, federal construction regulations, performance-based design 
and building construction, computerized fire models, and the policy implications of 
performance-based design. 

Chapter III explains the history of the development of the DHS ISC as it has 
evolved from the 1995 Department of Justice courthouse and office building vulnerability 
study to where it has come in 2012. 

Chapter IV discusses the modern history of building and fire codes in the United 
States to provide the context for the differences between prescriptive and performance- 
based codes, and how their features can be exploited to achieve desirable design and 
safety goals. 

Chapter V describes fire physics and behavior to provide a foundational 
understanding of the inputs used in the fire modeling analysis. 

Chapter VI explains how fire has been used as a weapon, and the impact of 
potential IID and accelerants on the built environment. 

Chapter VII describes the mixed method research approach, including the 
methods employed. It also includes the foundational data and findings that enable the 
policy analysis of the Physical Security Criteria for Federal Facilities standard and its 
supporting DBT. 
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Chapter VIII provides the analysis and recommendations of these documents to 
detennine whether the DHS ISC Physical Security Criteria for Federal Facilities 
standard can employ perfonnance-based design methods to evaluate the effectiveness of 
its pennanent countermeasure options to arson threats. 


13 
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II. LITERATURE REVIEW 


Research and writing about the protection of buildings from natural and manmade 
threats has a long history and a substantial body of literature ranging from architectural 
and engineering design through legally mandated construction regulations. Federally 
owned properties, because of their unique exempt legal status related to state and local 
building codes (based on the supremacy clause of the U.S. Constitution), are enjoined by 
the federal government’s own guidelines. The application of performance-based design 
methods to federal properties offers architects and tenants alike a contemporary means 
for evaluating building safety. This section reviews recent literature on construction 
guidance and the elements of perfonnance-based fire safe building design. 

A. FEDERAL FACILITY PROTECTION 

The acquisition, management, and protection of federal real property predate the 
founding of the republic. According to Kane, Anzovin, and Podell (1998), the first 
building erected in the United States for public use by the federal government was a brick 
structure for the U.S. Mint built on Seventh Street in Philadelphia. David Rittenhouse, 
director of the Mint, laid the cornerstone on July 31, 1792. 

The literature related to the construction and protection of federal facilities is vast, 
which ranges from federal laws through agency policy to administrative implementation 
guidelines. In the context of this study, the literature related to physical security and fire 
protection in the modem era begins with the Federal Property and Administrative 
Services Act of 1949 (40 U.S.C § 101 et. seq.). This law applies to the acquisition and 
management of property held by most government agencies and assigns responsibility for 
real property to the Administrator of General Services. Numerous agencies, such as the 
Department of Defense, the United States Coast Guard, the National Aeronautical and 
Space Administration, both houses of Congress, and the White House, are among many 
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of the agencies exempt from the act (U.S. Government Accountability Office, 2003). See 
Appendix C for the definition of public buildings, the scope of the Federal Property and 
Administrative Services Act of 1949, and exceptions from it. 

In 1992, the U.S. Congress amended the Federal Fire Safety Act to require 
automatic fire sprinkler systems or an equivalent level of safety in all new or significantly 
remodeled six story or taller federal office buildings (Boucher, 1992). Congress also 
required the GSA to develop regulations to define the term “equivalent level of safety” 
(15 U.S.C. § 2227 (d)). The eventual result was that designers were given three options to 
prove their proposal met an equivalent level of safety to a building with a complete 
automatic sprinkler system based on the building occupants’ ability to evacuate in a safe 
manner. In the first two alternatives, a measurable margin of safety 8 would be used to 
detennine the acceptability of the alternate design. The first option required that proposed 
alternate designs provide available safe egress times equal to those in a building provided 
with complete automatic sprinkler protection. The second option—recommended for 
typical office scenarios—required the designer to predict the estimated times that a fire 
would reach flashover, 9 would produce a heat release rate (HRR) of 1,000 kilowatts 10 
(1 MW), or leave the room where the fire began. The shortest of the three times would 
provide the baseline for available escape time. If the combination of proposed fire 
protection alternatives provided an adequate safety margin, that arrangement could be 
considered an equivalent level of safety. Finally, the third option allowed the government 
to accept other technical analysis procedures as long as they were conducted in 
accordance with recognized engineering standards (U.S. General Services 
Administration, 1994). 


8 The margin of safety is measured as the difference between available safe egress time and required 
safe egress time. “Available safe egress time is the time available for evacuation of occupants to an area of 
safety prior to the onset of untenable conditions in occupied areas or the egress pathways. The required safe 
egress time is the time required by occupants to move from their positions at the start of the fire to areas of 
safety” (U.S. General Services Administration, 1994, p. 52). 

9 The point at which a rapid change occurs in a developing room or compartment fire to full 
involvement. 

10 HRR is a measure of the energy released over time by a burning object. A 1,000-kilowatt HRR is 
approximately equivalent to the energy emitted from a fully burning upholstered chair. 
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Stroup (1998) used performance-based design and fire modeling techniques to 
evaluate the relative safety of two federal building projects, and found that while the 
proposed designs enhanced occupant safety, additional research was necessary to support 
the use of perfonnance-based design as a means to provide an equivalent level of safety. 

Six weeks after al Qaeda operatives attacked the World Trade Center with 
aircraft, President George W. Bush began issuing a series of Homeland Security 
Presidential Directives (HSPD) on matters pertaining to homeland security. On 
December 13, 2003, the President issued HSPD 7 “Critical Infrastructure 11 Identification, 
Prioritization, and Protection” that included a requirement that “all Federal department 
and agency heads are responsible for the identification, prioritization, assessment, 
remediation, and protection of their respective internal critical infrastructure and key 
resources” 12 (Bush, 2003). HSPD 7 covered those federal facilities included within the 
broad definition of critical infrastructure. 

Sternberg and Lee (2006) argued that federal emphasis on protecting other critical 
infrastructure—typically described as utility networks, transportation systems and key 
industrial sectors—was a homeland security focus that overlooked the importance of 
government facilities, which they define as “large and complex human-occupied 
structures.” 

One year after the aircraft terrorist attacks on the World Trade Center, the Federal 
Emergency Management Agency (FEMA) produced the first of two documents intended 
to help building designers and occupants address the threat of terrorist attack. The first, 
Integrating Manmade Hazards into Mitigation Planning (Federal Emergency 
Management Agency, 2002a), provided guidance to state and local governments to 
reduce or eliminate life loss and property damage from manmade disasters. It categorized 
human-caused hazards as technological hazards or terrorism. According to the document, 

11 Defined as “systems and assets, whether physical or virtual, so vital to the United States that the 
incapacity or destruction of such systems and assets would have a debilitating impact on security, national 
economic security, national public health or safety, or any combination of those matters” (See USA Patriot 
Act of 2001, 42 U.S.C. §5195 et. seq.). 

12 Defined as “means publicly or privately controlled resources essential to the minimal operations of 
the economy and government” (See Homeland Security Act of 2002, 6 U.S.C. §101 et. seq.). 
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technological hazards refer to incidents that arise from routine human activities, such as 
the manufacture, transportation, storage, and use of hazardous materials. Terrorism, on 
the other hand, is defined as intentional, criminal or malicious acts. 

The second FEMA publication, Reference Manual to Mitigate Potential Terrorist 
Attacks against Buildings (Federal Emergency Management Agency, 2003) described 
building fire hazards as technological accidents addressed in existing building codes, 
industry standards, and FEMA guidelines. The document acknowledged that: 

mitigation factors include built-in fire detection and protection systems 
and fire-resistive construction techniques. Inadequate security can allow 
easy access to target, easy concealment of an incendiary devices, and 
undetected initiation of a fire. Non-compliance with fire and building 
codes as well as failure to maintain existing fire protection systems can 
substantially increase the effectiveness of a fire weapon. (2003, p. 40) 

The document provided a “Building Vulnerability Assessment Checklist,” 
developed by the U.S. Department of Veterans affairs that compiled the best practices for 
design and construction based on contemporary technology and scientific research. 
Where guidance was provided on fire safety vulnerabilities, all the recommended 
solutions were based on existing prescriptive regulations and standards. 

B. GENERAL SERVICES ADMINISTRATION CONSTRUCTION 
REGULATIONS 

The GSA is responsible for the construction and management of all federally 
owned public buildings outside the District of Columbia and off military reservations. 13 
In 2010, the GSA’s Public Building Service (PBS) reported it managed more than 8,600 
leased and owned buildings with a gross floor area in excess of 351 million square feet 
(3.2609 x 10 m ). Of this, the GSA was responsible for more than 175 million square 

7 2 * 

feet (1.6258 x 10 m ) in more than 1,500 buildings, with the balance leased from private 


13 See 40U.S.C. §3101. 
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owners. The three primary types of facilities are federal office buildings, courthouses, 
and land ports of entry 14 (U.S. General Services Administration, 2010a, p. 2). Clearly, 
the federal government is a major user and occupant of real property. 

According to the Commission on Engineering and Technical Systems 
(Commission on Engineering and Technical Systems, 1989) “Federal agencies are 
exempt from these state and local building codes (and from zoning laws as well), and are 
entirely responsible for all aspects of safety and health in their buildings” (p. 2). 
However, the Public Buildings Act of 1988 15 specified that any building constructed or 
altered by the GSA or any other federal agency should be in compliance—to the extent 
feasible as detennined by the GSA administrator or in the case of national security 
needs—with the latest published edition of one of the nationally recognized model 
building codes (Legal Information Institute, 2011a). 16 Beginning in 1996, the GSA has 
published a series of mandatory design guides called “Facilities Standards for the Public 
Buildings Service (P100)” (U.S. General Services Administration, 2010a). Although not 
a building code in the typical context, the PI00 establishes GSA requirements for public 
buildings in the general areas of sustainability, energy conservation, physical security, 
and health and safety. 

In the area of fire protection and life safety, the PI00 standard establishes a 
perfonnance goal to: 

incorporate into all projects fire protection and life safety systems that are 
effective in detecting, extinguishing, or controlling a fire event, thereby 
improving overall building safety to an acceptable level. 


14 See Appendix A for the legal definition of “public buildings.” 

15 See 40 U.S.C. §3312. 

16 This legal mandate has been overtaken by events; in 1988, three nationally recognized model 
buildings codes existed. Today, the GSA P100 recognizes only one: the International Code Council’s 
International Building Code with modifications to the means of egress requirements where the National 
Fire Protection Association’s NFPA 101 Life Safety Code is required. 
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The primary goal is to protect human life from fire and products of 
combustion. The secondary goals are to reduce Federal Government and 
taxpayers’ potential losses from fire (i.e., protect Federal real and personal 
property, maintain client agency mission continuity, and control 
environmental impact). (2010a, p. 235) 

Although the goals describe key elements, such as occupant safety and the need to 
maintain mission continuity, arson related fire threats are not mentioned. In fact, the word 
arson does not appear in the PI00 standard. 

The PI00 standard requires that all projects have a licensed fire protection 
engineer on the architectural design team to conduct an overall building fire safety 
analysis, and specifically design features, such as the means of egress, fire protection 
water supply, and specialized fire protection systems. This private-sector fire protection 
engineer is authorized to propose deviations from the prescriptive PI00 construction 
requirements, and these must be submitted for approval to the GSA regional fire 
protection engineer who has oversight authority on fire protection and life safety features 
of the project (U.S. General Services Administration, 2010a). Alternative designs may 
include a perfonnance-based approach so long as the “proposed alternative is deemed 
equivalent of superior to the intent of the prescribed requirements” (p. 236) of the P100 
standard. In addition to the general fire protection design requirements, PI00 references 
other federal standards for special use occupancies. Table 3 summarizes these additional 
standards. 


Table 3. Special Federal Fire Protection Design Guides based on Occupancy (After: 

U.S. General Services Administration, 2010a) 

_ Occupancy _ Design Guide _ 

U.S. Courts P 100, Chapter 9 and the U.S. Courts Design Guide 


U.S. Marshal Service 

Land Ports of Entry 
GSA Child Care Centers 


USMS Requirements and Specifications for Special 
Purpose and Support Space, Volumes I, II, and III 

Land Port of Entry Design Guide 

GSA Child Care Center Design Guide (PBS-140) 
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The 2010 edition of PI00 includes references to the ISC Physical Security 
Criteria for Federal Facilities and adds special requirements if the ISC risk management 
process detennines the project under consideration to have high protection risk level (see 
Figure 2). In those instances, P100 requires that the project design team conduct a fire 
protection risk assessment of the building. According to the PI 00 standard: 

the fire protection risk assessment is a technical evaluation, based on 
professional rationale and judgment, of potential risks involved in 
achieving desired objective(s) (e.g., protection of life, the property, and 
the mission). It involves the measurement and complete documentation of 
conditions and features relevant to detennination and adjustment of the 
level of building safety and the adequacy of the protection provided. The 
overall combined effect of all positive features and negative conditions 
must be considered in the evaluation rather than the effects of a single 
item or concern. The result will be a logical and reliable determination of 
whether equivalent or alternative solutions exist for any or all negative 
conditions caused by an unwanted event. (U.S. General Services 
Administration, 2010a, p. 257) 


C. PRESCRIPTIVE DESIGN AND CODES 

Despite the long-standing application of prescriptive designs and codes, where the 
architect and building contractor are compelled to follow a prescribed set of materials and 
methods to satisfy safety requirements, no literature evaluates their effectiveness. Most of 
the research that exists is critical of prescriptive designs and codes in that they lack 
suitable safety objectives, stifle innovation, and needlessly increase the cost of building 
construction. Hadjisophocleous, Benichou, and Tamin (1998) reported in their own 
literature review that although prescriptive codes proved easy to verify compliance with 
the regulations, their drawbacks included the following. 

• Specific requirements were established with no clear objectives 

• Cost-effective designs were not promoted 

• Very little flexibility existed for innovation or unusual conditions 

• A presumption that there was only a single design solution that provided a 
level of safety (which itself was not defined) 

• Challenges applying them to large, complex buildings 
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In a follow-up article, Hadjisophocleous and Benichou (2000) reiterated their earlier 
findings that prescriptive codes “have the advantage that designers can do a design by 
just following prescriptions and that code officials can easily detennine whether a design 
follows code requirements” (pp. 140-141), but the impediments to innovation, the limited 
application to complex designs, and the lack of clearly articulated safety objectives 
remained. 

Oster and Quigley (1977) were critical that building codes acted as a deterrent to 
innovation in both building design and the use of new construction materials that could 
increase functionality and reduce costs. In 1981, the U.S. Department of Housing and 
Urban Development conducted a historical survey of the “Evolution of Building 
Regulations in the United States” (Building Technology, 1981). The report found that 
over time, building codes evolved to employ three primary technical requirements: 1) 
design requirements and criteria for building elements and systems for various 
occupancies, 2) specifications for construction materials, and 3) construction details. In 
all cases, these requirements were prescriptive in their nature. 

A sample of building code officials, who generally were employees of local 
governments, and were charged with the interpretation, application, and enforcement of 
construction codes, were polled in 1996 to research their willingness to accept 
perfonnance-based designs, which then were a relatively new concept in building 
construction. Van Rickley (1996) found that almost 80% of those polled agreed with the 
statement “prescriptive building and fire codes, as they currently are written, are 
necessary to ensure reasonable levels of fire protection and life safety” (p. 43). In a study 
assessing the potential economic opportunities for wood products in non-residential 
building construction, Goetzel and McKeever (1999) found that prescriptive building 
codes limited the structural size and height of buildings, especially where combustible 
construction was employed. 

Lord and Marrion (2003) studied building codes in six developed nations and 
found that the prescriptive codes did not always provide the design flexibility or 
functional needs expressed by a developer or tenant, and provided only a limited set of 
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solutions. Siu (2005), in an evaluation of three historically significant high-rise office 
fires, 17 found that after each of the events, “the question has been raised whether 
prescriptive building codes provide adequate protection for the structure” (p. 1). Siu 
added that the economic and societal losses of the three buildings also proved that 
prescriptive building codes were not adequate to protect buildings from fires. Licht 
(2005) argued that technical changes that occurred during consolidation of the three 
national model prescriptive codes 18 into a single document resulted in an overall 
reduction in fire and life safety, and especially, put fire fighters at risk. 

In projects not particularly complex or requiring unusual design features, 
prescriptive codes can satisfy basic design and occupancy needs. Occasionally, however, 
specific circumstances arise that do not fit within the strict confines of a prescriptive 
code. To address these conditions, the legacy and current model construction codes 
permit the designer to propose the use of alternate methods or materials, as long as the 
resulting construction is determined to be equivalent to the requirements of the 
prescriptive code. In these cases, mixing prescriptive requirements with performance- 
based designs may satisfy both the code official and the pennit applicant. Mirkhah 
(1997b) found this approach to provide a desirable solution to a complex design problem 
for a unique high-rise entertainment structure in Las Vegas. Geren (2004) supported this 
approach as a means of providing modem building designs without sacrificing safety or 
quality. 


17 The fires occurred in the First Interstate Bank in Los Angeles, May 4, 1988, One Meridian Plaza in 
Philadelphia, February 23, 1991, and New York’s World Trade Center Building 7 on September 11, 2001. 
The outcome of these fires and the buildings’ performance has been studied extensively among fire 
protection professionals. 

18 The Building Officials and Code Administrators International National Building Code , the Southern 
Building Code Congress International Southern Standard Building Code, and the International Conference 
of Building Officials Uniform Building Code were consolidated in 2000 into the International Building 
Code. 
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D. PERFORMANCE-BASED DESIGN 


Performance-based fire safe building design 19 is grounded in scientific and 
engineering principles used to solve fire protection and life safety challenges. 
Consequently, a substantial portion of the literature addresses results from empirical fire 
research and human behavior studies. Less contemporaneous writing on the policy 
implications of perfonnance-based design is occurring, and a growing body of opinion on 
its merits is appearing. In Europe and Pacific Asia, where performance-based design has 
been established since the mid 1980s, the policy literature is richer. Also, a group of 
professionals are wary of performance-based fire safe building design, and argue that 
longstanding consensus-based prescriptive methods better serve fire safety needs because 
of their built-in redundancies that have accumulated from collective fire experiences. The 
modeling documentation often used in perfonnance-based design is not yet developed 
enough to be reliable. 

Perfonnance-based fire safe design advocacy started in the United States in the 
mid-1960s. Watts, Jr. (1966) argued for a fire safety objectives approach in an editorial in 
Fire Technology, the quarterly scientific and engineering research journal published by 
the National Fire Protection Association. He suggested that scientists and engineers 
needed to move from vague statements to a precise and specific measure of perfonnance. 

In the United States, the seminal literature for perfonnance-based design was a 
report prepared by the U.S. General Services Administration (GSA) in 1972 entitled 
Building Fire Safety Criteria, Appendix D: Interim Guide for Goal-Oriented Systems 
Approach to Building Firesafety. 20 The report was the result of a GSA conference in 
1971, an International Conference on Fire Safety in High-Rise Buildings (Meacham, 
1998c). The document provided a groundbreaking new approach to building design by 
“demonstrating that engineers can view the building and fire as integral components of a 


19 For simplification, the term performance-based design is used throughout this text as a general term 
that encompasses performance-based, objective-based, and functional design (Meacham, 1998a). 

In the fire protection field, spelling “fire safety” as a single word, “firesafety,” is a commonly 
accepted practice. 
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single system, and that [the traditional method of] evaluating or designing individual 
components without regard to the system, potentially severe shortcomings in the design 
could result” (Meacham, 1998a, p. 4). 

As a proof of concept that could be applied to a GSA project then under 
development, engineers borrowed an event logic diagram that became known as the fire 
safety concepts tree. The diagram was founded in the system safety analysis and fault tree 
analysis process developed by the National Aeronautics and Space Administration to 
enhance reliability in the nascent space program. This logic-based decision-making tool 
eventually became the National Fire Protection Association (NFPA) NFPA 550, Guide to 
the Fire Safety Concepts Tree (National Fire Protection Association, 1995). Starting with 
the goal of “prevent fire ignition,” the fire safety concepts tree plotted fire safety design 
objectives through a series of “OR gates” that gave designers alternatives to choose one 
solution or another. 

The U.S. Department of Commerce National Bureau of Standards followed the 
GSA interim guide in 1979 21 and the U.S. Department of Health, Education and Welfare 
study A Theoretical Rationalization of a Goal-Oriented Systems Approach to Building 
Fire Safety (Watts Jr., 1979). This report articulated the concepts of deterministic and 
probabilistic approaches to fire safe design as alternatives to traditional prescriptive 
compliance. The detenninistic approach “presumes an ability to determine the precise 
behavior of any fire at any time in the future, given exact contemporary conditions and 
the antecedent state of the building and its contents” (Watts Jr., 1979, p. 7). At this time, 
Watts Jr. acknowledged not enough scientific data existed to employ this method. 

On the other hand, the goal-oriented or probabilistic approach derived in the GSA 
Appendix D, reasoned that a certain amount of hazard was unavoidable and that “a fire 
safety goal, such as maintaining the continuity of an organizational mission, could be 
expressed in terms of a probability of limiting fire extent” (Watts Jr., 1979, p. 9). 


The National Bureau of Standards is now the National Institute of Science and Technology. 
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Beck (as cited in Meacham, 1998a) conducted research in Australia to develop a 
building fire safety model that estimated the level of risk for the particular building being 
modeled. The model was based on the probability of events occurring at a specific time 
related to the time of fire ignition. The model used five sub-systems (nature of 
occupancy, fire growth and development, smoke management, flame management, and 
occupant avoidance and fire fighting) to identify consequences in terms of the number of 
people exposed to dangerous conditions (Meacham, 1998a). 

The next significant development in the literature was Fitzgerald’s Building 
Firesafety Evaluation Method created in 1985 (as cited in Meacham, 1998a). Unlike the 
fire safety concepts tree, Fitzgerald’s approach was to work inversely from a likely 
ignition scenario and, using network diagrams, evaluated factors, such as ignition 
potential, fire growth potential within, and from a compartment, 22 and occupant safety. 
Within the network, at any point, an experienced user could apply subjective 
probabilities—or statistical data—to estimate the likelihood of each event occurring with 
an anticipated outcome that was the likelihood of whether any event will or will not occur 
(Meacham, 1998a). 

In the 1980s, a substantial portion of the literature focused on empirical fire and 
human behavior studies (see next section). During this time, several countries, including 
the United Kingdom (UK), Japan, Australia, and New Zealand, rewrote their national 
building regulations to de-emphasize prescriptive requirements, and encourage 
performance-based solutions. 

By 1998, although much of the rest of the developed world embraced 
perfonnance-based designs, in Assessment of the Technological Requirements for the 
Realization of Performance-Based Fire Safety Design in the United States—Phase 1: 
Fundamental Requirements, Meacham found that the United States was still reluctant to 
do so because of the lack of documentation and credibility of the state of engineering 


22 In the fire protection field, a compartment generally describes a space having boundaries of at least 
a floor, walls, and ceiling. The size, shape, slope, materials, and dimensions of each plane are immaterial at 
this level of definition. 


26 



tools and methodologies for fire safe building design (Meacham, 1998a). The Society of 
Fire Protection Engineers and National Fire Protection Association in 2000 took a major 
step toward resolving the documentation and protocol issues by publishing The SFPE 
Engineering Guide to Performance-Based Fire Protection Analysis and Design of 
Buildings. This workbook provided a step-by-step method to identify and document the 
design parameters employed in performance-based projects (National Fire Protection 
Association & Society of Fire Protection Engineers, 2000). 

In “Accommodating Perceptions of Risk in Performance-Based Building Fire 
Safety Code Development,” Wolski, Dembsey, and Meacham (2000) introduced the two 
methods of adding risk factors to buildings, and categorized them as low, medium, or 
high risks. In the first method, risk adjustment factors could be adjusted during the 
detenninistic analysis of the building design to assess if additional fire safety features 
would be needed. The second method would be applied during the probabilistic approach 
to develop risk conversion factors related to expected-risk-to-life values so design 
adjustments could be made dependent upon the perceived fire safety risk to occupants. 

Bukowski (2006) provided a post-September 11, 2001 assessment in Determining 
Design Fires for Design-Level and Extreme Events. The jet fuel-fed fires that destroyed 
the World Trade Center north and south towers exceeded the commonly anticipated scale 
of performance-based designs for past and current high-rise office buildings. 

More recently, a federal interagency working group consisting of representatives 
from DHS, Department of Justice, U.S. Nuclear Regulatory Commission, the GSA, and 
Administrative Office of the U.S. Courts, published a design standard entitled Physical 
Security Criteria for Federal Facilities: An Interagency Security Committee Standard 
(U.S. Department of Homeland Security, 2010c). The standard strongly emphasizes the 
importance of a facility security committee that identifies threats, vulnerabilities, and 
countenneasures as part of a risk-based decision process for design, which is a significant 
step toward a performance-based fire safe design in federal facilities. 

When stakeholders and the design team establish a project’s fire safety objectives, 

a critical point of agreement must occur regarding the nature of what are called design 
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fire scenarios. These scenarios generally include the range of fire challenges that could or 
likely would occur in a given building or facility based on the nature of its use, contents, 
and even threats. It is the variety of scripted fire scenarios against which the design team 
must show its proposed solutions will mitigate or control the event as a measure of 
success, which is one of the shortcomings of the Physical Security Criteria for Federal 
Facilities: An Interagency Security Committee Standard. Without a clearly articulated 
arson fire scenario, rational countermeasures to address the threat or reduce 
vulnerabilities cannot be developed and prescriptive solutions may not be satisfactory. 
Zalok and Hadjisophcleous (2009) found that “the development of a design fire scenario 
is a combination of hazard analysis and risk analysis. Hazard analysis identifies potential 
hazards, such as ignition sources, fuels, and fire development. Risk analysis includes the 
indicated hazard analysis and the likelihood of occurrence (either quantitatively or 
qualitatively), and the severity of the outcomes” (Zalok & Hadjisophocleous, 2009, p. 
1082). 

According to the SFPE (National Fire Protection Association & Society of Fire 
Protection Engineers, 2000), each scenario should define three components: fire 
characteristics, building characteristics, and occupant characteristics. Fire characteristics 
include the anticipated range of possible fire scenarios from an unintentional error to an 
arson attack. The potential rate of fire growth, its expected time to flashover, and when it 
may be extinguished, must be considered. Building characteristics include architectural 
features, such as large open spaces or small compartments, structural components and 
building materials, fire protection systems and equipment, building services (e.g., 
heating, air condition, elevators and escalators), and fire department response capabilities. 
Occupant characteristics include the potential number of occupants, their distribution 
through the building, alertness, mobility, and physical or psychological conditions. 

As part of its PI00 “Facilities Standards for the Public Buildings Service,” the 
GSA adopted the national consensus standard NFPA 101, “Life Safety Code.” The 
standard includes eight design fire scenarios that must be used if an architect or engineer 
elects to use a performance-based design approach in lieu of a prescriptive method. Table 
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16 summarizes the elements of the eight design scenarios. Yung and Benichou (2002) 
offered a sample of six different design fire scenarios based on the nature of the fire 
(smoldering, flaming or flashover) and whether the entrance door to the room in which 
the design fire occurred was open or closed. They also acknowledged that the prediction 
of fire growth in a room—before it happens—was difficult due to the almost limitless 
number of configurations of the type, quantity, and arrangement of combustible contents, 
as well as where those combustibles might be ignited: 

The proposed design fires depend only on parameters that can be 
characterized a priori , 23 such as occupancy type, amount of combustibles, 
size of the compartment, and the ventilation conditions. Random 
parameters, such as the arrangement of the combustibles and the point of 
ignition, are taken into consideration by using statistical infonnation on 
probabilities of fire types. (Yung & Benichou, 2002, p. 232) 

This statement on the need to evaluate random parameters is important in the assessment 
of protecting federal facilities. Although Yung and Benichou emphasized the need for 
statistical sampling on fire types, they did not mention significant statistical anomalies, 
such as the World Trade Center attacks of September 11, 2001. This shortcoming may be 
due to the fact their research was presented in 2000, 24 and published only two years later. 

In a 2003 report commissioned by the National Science Foundation, (Lucht et ah, 
2003) found that current performance-based design and building practices offered “real 
promise for regulators and public officials to institute regulations that reflect a better 
understanding of risks and improved safety perfonnance for buildings in their 
communities” (p. 3). 

Thompson and Bank (2007) compared existing perfonnance based design 
practices and standards for seismic protection and fire safety, and detennined an 
opportunity does exist to use performance based design protocols for temorism resistant 
buildings. They claimed the first step toward acceptance of this method would be the 
ability to characterize the types of terrorism-related hazards facing building designers and 

22 In this context, “before the event.” 

24 Yung and Benichou’s paper originally was presented at the 5th Fire Risk and Hazard Assessment 
Research Application Symposium in Atlantic City, New Jersey, June 28-30, 2000. 
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criteria for acceptable levels of risk. Thompson and Rank reported, “to be truly effective 
at improving the safety of building occupants, a methodology must address the full range 
of terrorism-related threats, including not only traditional blast attacks, but chemical and 
biological agent attacks, and attacks on any system in the building” (p. 66). 

Bwalya (2009) reported that the choice of design fires must be influenced by the 
nature of the fire safety assessment or design tasks being undertaken. While the routine 
concerns about the type and nature of combustibles, ignition method, fire growth, and fire 
decay were important, “there is a requirement for the design fire to represent a fire that 
presents a formidable challenge to whichever fire safety feature or aspect of a building is 
being evaluated” (p. 181). 

E. COMPUTERIZED FIRE MODELS AND VALIDITY 

In developing and evaluating the safety objectives in perfonnance-based designs, 
it is not feasible to build a full-size version of the building or facility under study and set 
it on fire to observe the outcome. Consequently, computerized fire effects models often 
are used to test hypotheses and assess the potential outcome of design fires. It is 
important to note that fire effects models are not predictive, but are representative of data 
collected from full- and small-scale fire tests and post-incident analysis of real world 
events. Can fire modeling results be considered valid for their applicability to building 
and facility design where human lives are at stake and property must be protected from a 
variety of threats? In the fire protection context, validity is a measure of the model’s 
ability to replicate real world fire events. Models continue to improve as they are 
compared to experimental (live) fires and data sets become richer in the scientific and 
research literature. 

Fire effects models are divided into four major categories that simulate the fire 
environment: zone, field, large eddy simulation, and direct numerical simulation models 
(Gissi, 2010). All use complex mathematical fonnulas to quantify the physical 
characteristics of the fire environment. Zone models typically are one- or two- 
dimensional, and operate on the assumption that the space where the fire is being 
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modeled—generally called a compartment—is divided into two realms: an upper zone of 
hot fire products of a relatively unifonn temperature and composition, and a cooler lower 
zone containing some amount of contaminants. Field models divide the compartment 
being studied into three-dimensional cells (the size of which can be adjusted) and the 
calculations describe the physical interaction between and among cells that thus enable a 
more detailed assessment of the fire environment. Zone models tend to be less 
sophisticated and require less computing capacity. Field models are more complex and 
require powerful computers. 

Large eddy simulations attempt to capture accurate relationships between the 
turbulent mixing of gases and combustion products within the immediate area around the 
fire (Gissi, 2010). They require smaller computational grids and substantial computing 
power and speed. Direct numerical simulation performs complex equations without any 
discrete space or time considerations for turbulence, which means the entire fire 
environment is modeled simultaneously. According to Gissi (2010), direct numerical 
simulation is the most sophisticated means of fire simulation, and consequently, exceeds 
the capacity of the most powerful computers available today. 

Other computer models employed in fire protection analysis include tools that 
simulate the response time of fire detection devices, such as heat detectors or automatic 
sprinklers, egress models that evaluate human movement in buildings to assess 
evacuation perfonnance, fire endurance models to evaluate how various building 
components react to fire exposure, and models that address detailed topics, such as glass 
breakage, smoke movement, or flame spread. 

Attempts to model complex fire behavior began in the late 1950s when Japanese 
researcher Kawagoe studied the relationships between temperature and ventilation on the 
outcome of room fires (Kawagoe, 1958). Subsequently, a number of researchers began to 
develop hand-calculated mathematical formulas to explain fire behavior that they studied. 
The expansion of the electronic computer in conjunction with the growing international 
study of fire behavior has made fire modeling a preferred tool in the evaluation of 
performance-based designs. By 1992, one survey of the contemporary state of fire 
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modeling found 74 models from 13 countries were then in use (Friedman, 1992). The 
understanding of fire behavior and the ability to replicate it in computerized fire models 
has progressed dramatically in the last 20 years. 

Friedman (1992) found that models he surveyed might not compare to actual fire 
behavior for any of the five following reasons. 

• Idealizations and simplifications on which the model was based might 
deviate significantly from real world conditions 

• Input parameters (data entry) supplied to the model were inaccurate 

• Defaults values of the coefficients in the underlying computational 
routines were flawed 

• The computational process itself yielded incorrect results due to time and 
scaling problems in the mathematical equations 

• The experiments themselves were not correct or could not be repeated 

In 1996, Babrauskas reported that contemporary fire models were unable to 
reproduce even the most fundamental characteristics of fire behavior. Babrauskas’s 
survey (1996) found that modeling software in use at the time was unable to reproduce 
flame spread, heat release rate, fire or smoke chemistry (especially the production of 
carbon monoxide), a realistic mixing of heated gas layers within a compartment, or the 
influence of fire suppression. 

To provide professional design guidance, in 1997, ASTM International (ASTM) 25 
published two documents: Standard Guide for Determining the Uses and Limitations of 
Deterministic Fire Models (ASTM El895) and Standard Guide for Evaluating the 
Predictive Capability of Fire Models (ASTM E1355). The first provided guidance for 
users and code officials in establishing the appropriate uses and limitations of fire models 
in fire risk and hazard assessments (ASTM International, 2007). The second, ASTM 
El355, provided methods for evaluating models by comparing their analytical precision 
to standard fire tests, full-scale fire experiments, field experience, published literature, or 
previously evaluated models (ASTM International, 2011). 

Formerly the American Society for Testing and Materials. It is a non-profit organization for 
developing, delivering, and coordinating voluntary consensus standards. 
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In 2002, 16 researchers from 10 countries conducted a round robin modeling 
exercise to compare their results from a single fire scenario. The purpose of the round 
robin was to detennine if modelers could obtain similar results from the same inputs, and 
thereby, validate the models’ reliability to portray real world events. The design fire 
consisted of a single room with a wooden material fire source. The participants used two 
field models and nine two-zone models in their assessments. After comparing fire model 
outputs to live experimental fires, Keski-Rahkonen and Hostikka (2002) found deviations 
between the modeled results and the live fire data, principally because the types of fires 
were not well suited for the zone models. They also found discrepancies in the results 
ranging from ± 10% up to a factor of two, which were in the same range of uncertainty as 
the experimental data. However, the differences were attributed not to the models, but to 
the skills of those performing the data input. 

By 2003, Olenick and Carpenter found the number of fire models had grown to 
almost 140, and that computer modeling of fire and smoke transport was becoming a 
more accepted practice because of improvements both in knowledge about fire behavior 
and improved computer perfonnance. Olenick and Carpenter (2003) reported that since 
Friedman’s survey, “increased use of modeling is also attributable to the move towards 
performance-based building codes in the United States and other countries. Instead of 
using a prescriptive building code, engineers now can design for egress of building 
occupants under varying fire conditions” (Olenick & Carpenter, 2003, p. 88). 

Salley et al. (2007) assessed the accuracy of fire model results and found that for 
some study areas, zone models were adequate (e.g., ceiling temperatures and flame 
heights), and the more sophisticated field models were better suited for some analysis 
(e.g., predicting heat flux and fire behavior in asymmetrical compartments). However, for 
complex fire scenarios, design engineers should employ field modeling because the 
results are likely to be more reliable. 

Beard (2008) expressed apprehension that an inexperienced user may interpret the 
fact that a model has been validated means it somehow will accurately predict real world 
conditions. This perception is a legitimate concern of many fire protection professionals 
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who fear that an inexperienced or disingenuous modeler may use the technique 
inappropriately. According to Beard (2008), different users of a model may produce very 
different results based on inputs and variable controls. The next year, Beard cited the 
following potential error sources in modeling. 

• Inputting data presented as a realistic depiction of real world events 
without acknowledging that the conceptual and numerical assumptions in 
a model were only an approximation of actual fire behavior 

• Failing to follow the strict protocols for the model being used that 
potentially could result in both mathematical miscalculations and errors in 
scale 

• Fundamental computational errors in the software. Beard claimed one 
estimate suggested as many as eight possible errors for each 1,000 lines of 
computer source code 

• Faults in computer hardware that might be the result of a flawed micro¬ 
processor design, manufacture, or a combination of both 

• Errors entering data or interpreting the results 

• Inadequate documentation that implies the model selected is appropriate 
for the scenario being represented when it may not be the best available 
tool (Beard, 2009) 

In their assessment of one of a series of highly instrumented and documented 
apartment fire tests in Dalmamock, Scotland, Rein, Jahn, and Torero (2011) found that 
fire simulations conducted before the live fires (a priori) dramatically overpredicted 
temperatures of hot gas layers and surfaces by 20 to 800 percent. A posteriori modeling 
reduced the error range to 10-200 percent. They concluded the following. 

• Even in a posteriori simulations (with full access to the measurements) it 
is not easy to reproduce the fire 

• The incapability of predicting fire growth is shown to be a fundamental 
constraint to fire modelling [sic] 

• When the HRR [hear release rate] is unknown as it is in most practical 
cases, the use of lower and upper HRR bounds should be included as to 
reflect in the predictions the effect of uncertainty in the HRR. This is an 
important issue for the application of fire modelling [sic] to real scenarios 
when the HRR us unknown (i.e., [sic], forensic investigation and assumed 
design scenarios), (p. 10) 
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Jahn, Rein, and Torero (2008) reported that fire-modeling tools provide good 
predictions of the thermal consequences of a fire, but their ability to predict fire 
development and HRR is problematic; therefore, it is incumbent on the modeler to 
specify the HRR input variable. In a recent study, Zalok and Hadjisophocleous (2009) 
attempted to create virtual fuel load configurations in seven different commercial-type 
buildings. The purpose was to develop data inputs based on fuel load surveys that could 
be inputted into a fire effects model, 26 and thereby, reduce the need to conduct detailed 
surveys or conduct full-scale fire tests. They found that “although models might not 
always give accurate predictions, the results of validated models can be used with 
confidence in the design of fire protection systems” (p. 20). Their research showed that 
the difference between predicted peak HRR and the experimental peak HRR was less 
than 16%, “giving confidence in the model for use in predicting more complicated cases” 
(2009, p. 20). 

F. FIRE AND BEHAVIOR STUDIES 

Empirical fire research and human behavior studies for performance-based fire 
safe building design are intended to quantify the interaction among fire ignition, product 
or material combustibility, fire and smoke behavior, building structural and fire resistance 
features, fire protection systems and human behavior, such as relocation, shelter-in-place, 
or evacuation. These studies have helped designers better understand the role of these 
elements in a single system. While these studies add substance to the engineering 
applications of performance-based designs, they are outside the scope of this thesis, 
which is focused on policy implications of performance-based fire safe building designs. 

Titles, such as Natural Smoke Filling in Atrium with Liquid Pool Fires Up to 1.6 
MW (Chow, Li, & Huo, 2001), A Computational and Experimental Study of Fire Growth 
and Smoke Movement in Large Spaces (Kashef, Benichou, Lougheed, & Mccartney, 
2002), Experimental Fire Tower Studies of Elevator Pressurization Systems for Smoke 
Control (Tamura & Klote, 1987), Characterization of Fire Induced Flow Transport 

26 In this study, they evaluated a field model. Fire Dynamics Simulator. 
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Along Ceilings Using salt-Water Modeling (Yao, 2006), and A Performance Based 
Methodology Using Travelling Fires for Structural Analysis (Spence, 2000), illustrate the 
scope and scale of empirical fire behavior studies. Many of the studies focused on a 
single fire behavior or the performance of a single building component when exposed to 
controlled fires in a laboratory. 

Magnusson, Frantzich, and Harada (1996) in “Fire Safety Design Based on 
Calculations: Uncertainty Analysis and Safety Verification” described results from 
occupant evacuation studies conducted in a one-room public assembly building using a 
number of uncertainty analysis procedures including the analytical first-order second- 
moment (FOSM) method, two numerical random sampling procedures (simple random 
sampling and Latin hypercube sampling), and standard probabilistic risk analysis 
methods. Their work was just one of several that studied human behavior in fires that 
reviewed both reaction and response times to queuing and evacuation actions. 

G. GLOBAL EXPERIENCE WITH PERFORMANCE-BASED DESIGN AND 

CODES 

In Europe and Pacific Asia, perfonnance-based fire safe designs have been 
employed for more than two decades. These designs have provided the designers and 
regulatory authorities an opportunity to assess the success or failure of this design option. 

In Hong Kong, Walters, and Hastings (1998) studied 14 years of disastrous 
multiple-death fires in that colony, and found that in addition to cultural complacency, a 
weak and outdated regulatory environment correlated to the significant losses. They 
noted in Fire Safety Legislation in Hong Kong, for the latest fire codes of practice that 
are applicable to new work, “the Government has started to include perfonnance-based 
criteria as an ‘alternative approach to fire engineering.’ The use of perfonnance codes 
requires legislators and policy makers to be explicit in their objectives and standards of 
public welfare and safety” (p. 253). New Zealand has substantial experience with 
perfonnance-based fire safe building design. Buchanan produced a small study from nine 
city councils around the country entitled “Implementation of Perfonnance-Based Fire 
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Codes.” The results showed survey participants believed the new codes resulted in a 
major increase in perceived safety for building occupants, but a significant decrease in 
property protection (Buchanan, 1999). 

On the other hand, Buchanan, Deam, Fragiacomo, Gibson, and Morris (2006) 
found that performance-based design has increased architectural flexibility and reduced 
construction costs, but also resulted in some problems including different levels of 
enforcement across the country, and poor workmanship, especially where local building 
inspections have been insufficient to ensure the expected quality of design or on-site 
workmanship from the small number of poorly qualified designers or sloppy builders 
who cause problems. Buchanan et al. findings were corroborated by additional research 
in “Performance-Based Regulation and Regulatory Regimes: The Saga of Leaky 
Buildings” (May, 2003). Consequently, New Zealand has had to adopt stricter building 
code regulations. One study, New Zealand Fire Service Design Review Audit, identified 
poor submittal documentation as a problem for regulatory officials (I. Thomas, 2006). 
New Zealand recently modernized its fire safety approach in building codes with the 
creation of “Verification Method: Framework for Fire Safety Design” (New Zealand 
Ministry of Business, Innovation and Employment, 2012) that requires a chartered 
professional engineer to satisfy 10 design fire scenarios with detailed consideration given 
to six parameters: fire growth rate, peak heat release rate, fire load energy density, gas 
species production (carbon monoxide, carbon dioxide, water and soot), heat flux, and 
time. The new regulations are intended to require a greater level of detail in fire modeling 
data inputs to achieve a more robust analysis of the outputs. 

Canadian researchers Hadjisophocleous and Benichou (1999) found that 
perfonnance-based design strategies often were used to satisfy alternative material and 
method solutions for satisfying rigid prescriptive building code requirements. In South 
America, Tavares (2009) began studying Brazilian cultural acceptance of perfonnance- 
based designs in his work “An Analysis of the Fire Safety Codes in Brazil: Is the 
Perfonnance-Based Approach the Best Practice?” 
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Swedish authors, Cronsioe, Stromgren, Tonegran, and Bjelland (2012), reported 
that too much freedom in the application of performance-based design might increase the 
uncertainty in levels of fire safety. They advocate a more consistent transnational 
approach (especially in Europe) to identify appropriate fire safety objectives while 
accounting for differences among legal frameworks, practitioner skills, and code 
officials. 

H. POLICY CONSIDERATIONS 

The goal of performance-based design is to make architectural decisions on well- 
articulated scientific and engineering principles while encouraging design freedom, 
reducing costs, and minimizing construction redundancies that have evolved in the 
prescriptive methods. For years, owners, architects, and builders have been constrained 
by the obligation to “meet the code,” often without a logical or contemporary nexus to 
fire behavior or occupant safety. The potential change from prescriptive to perfonnance 
methods has policy impacts for the government and its constituents. 

In the UK, Europe, and Pacific Asia, prescriptive building regulations that had 
been in place for many years have given way to perfonnance-based solutions. In the UK 
for example, prescriptive building regulations that had evolved from the 1666 Fire of 
London had grown to more than 300 pages. The government initiated an effort to 
increase design flexibility—and “produce a more intelligent system”—by publishing its 
23-page Building Regulations that still covered essential safety, health, and comfort 
standards (Meacham, 1998a, p. 13). Similarly, the Japanese rewrote their building 
standards law into The Total Fire Safety Design System of Buildings (Japan Ministry of 
Construction, as cited in Meacham, 1998a). In Australia, a Building Regulation Review 
Task Force developed the first draft of that country’s performance-based code, the 
National Building Fire Safety System Code (Meacham, 1998a). 

In the United States, the local or state jurisdictions must promulgate and enforce 
building and fire safety. Not only is this an authority vested in the states by the U.S. 
Constitution, but it has historical precedent as well. In the United States, individual states 
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and communities often developed their own building and fire safety codes. In an article 
on regulatory barriers to innovation and marketing residential properties, Oster and 
Quigley (1977) found “the bewildering variation in local regulations may very well mean 
that potentially profitable innovations are also illegal in many geographical areas. This 
reduces both the scale at which an innovation can be marketed and its profitability, and 
may further discourage R & D investment” (p. 363). They added, “Ideally, construction 
standards would be a codification of performance specifications for newly constructed 
dwellings” (p. 365). 

In 1927, the West Coast Fire and Building Officials, later known as the 
International Conference of Building Officials, published the first “model” 27 prescriptive 
building code, the Uniform Building Code followed by the Standard Building Code, 
published by the Southern Building Code Congress International in 1946, and the 
Building Officials and Code Administrator’s National Building Code published in 1950 
(Bukowski, 1997). All these documents established prescriptive design requirements, and 
generally were updated on a three-year cycle to meet changing technology and market 
conditions. 

The three organizations competed for primacy with the building and related 
construction codes until 1994 when the groups merged to fonn the ICC that now 
publishes the prescriptive International Building Code. In 2001, the ICC published the 
first American perfonnance-based code, the ICC Performance Code for Buildings and 
Facilities. Another organization, the National Fire Protection Association, publishes a 
competing building code containing perfonnance-based elements, NFPA 5000, Building 
Construction and Safety Code. The National Fire Protection also produces NFPA 101, 
Life Safety Code that includes a variety of performance-based design solutions within its 
criteria. 

In 1993, in Status of Performance Fire Codes in the USA, Snell summarized the 
current state of perfonnance-based design acceptance within the United States. He found 

27 Model codes are intended to be sufficiently generic so that any community code can adopt them as 
published, which results in a comprehensive and legally defensible set of building regulations. 
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that while the potential benefits of design freedom and cost saving were admirable, the 
research, technological, and legal foundations for the method had not yet gained 
acceptance. He optimistically expressed that modem advances in computing, 
telecommunications, simulation, and expert systems would offer exciting mechanisms to 
solve many of the design and application challenges (Snell, 1993). 

Meacham (1998b), a prolific author and advocate for perfonnance-based fire safe 
building design, summarized the state of its acceptance in Concepts of a performance- 
based building regulatory system for the United States. The report provided input on why 
the United States was moving toward a perfonnance-based design system, what 
components were needed to make it work, and what education and qualifications issues 
needed to be addressed among practitioners and regulatory officials. 

Bukowski (1997) pointed out that a significant cultural shift among designers, 
engineers, and code enforcement officials will be needed to embrace the move to 
performance-based designs. This change will require: 1) better training and education, 2) 
consensus upon which analytical techniques and data are appropriate for assessing 
designs, and 3) recognition that perfonnance based designs will rely on new fire 
protection system technology more than fire-resistive construction and materials. 

In a legal context, Coglianese, Nash, and Olmstead (2004) reported that 
“expanding the use of perfonnance-based regulation holds promise for achieving health, 
safety, and environmental goals at a lower cost and for doing so in a way that 
accommodates if not encourages technological innovation” (p. 723). In their 
Performance-Based Regulation: Prospects and Limitations in Health, Safety and 
Environmental Protection, they found the design and cost-savings advantages of 
performance-based regulation do not necessarily mean it is always the best regulatory 
strategy. 

In “Risk-Informed Performance-Based Approached to Building Regulation,” 
Meacham (2010) reported a growing worldwide interest in combining risk analysis and 
engineering data with stakeholder interests to establish meaningful perfonnance levels 

and criteria. Meacham stated that “keys to success include providing thorough yet 
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transparent decision framework, adequate data and analysis tools, and good stakeholder 
communication” (p. 892) all of which should be readily available in the federal 
government decision-making environment. 

I. ALTERNATE VIEWS 

Some are circumspect about performance-based design. Most notably, attorney 
and University of Maryland School of Fire Protection Engineering professor Vincent 
Brannigan has written extensively in American journals and periodicals regarding his 
concern that although technical inputs can be provided in performance-based designs, the 
unpredictable “human factor” may obviate a successful fire outcome (Brannigan & 
Smidts, 1999). He also expressed concern that no public policy mandate exists to move 
from the traditional prescriptive methods of design and construction, and what constitutes 
a reasonable level of safety is ill-defined in the performance-based design vernacular 
(Brannigan, 2001b). 

In 2002, Brannigan expressed additional concerns about perfonnance-based 
designs that may not consider the full impact of events that threaten buildings. 

Arson is a special issue for perfonnance-based design because of 
engineering design optimization, a well-known problem. Highly 
engineered structures have clear-cut design specifications, but if 
something isn’t reflected in the requirements, the structure may not be able 
to handle the problem. The engineers who optimized the Titanic designed 
it to hit icebergs head on, not to scrape along the side. The engineers who 
designed airbags made them safe for the 5-foot-9-inch, 160-pound 
passenger, but fatal to shorter people. (Brannigan, 2002) 

He was equally concerned that the recently developed ICC Performance Code for 
Buildings and Facilities was legally flawed as a regulatory statute because its overall 
social objective for fire safety was not clearly articulated in legal terms (Brannigan, 
2001a). In 2002, Brannigan softened his position somewhat and encouraged the use of 
“proportionate response” cited in the ICC Performance Code for Buildings and Facilities 
where the design and response of the building is proportionate to the potential fire threat 
(Brannigan, 2002). 
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Babrauskas (n.d.) in “Performance-Based Building Codes: What Will Happen to 
the Levels of Safety?” argued that successful strategies for perfonnance-based design can 
be implemented, but that designers and regulatory officials should proceed cautiously 
before accepting them as a wholesale solution to fire protection challenges. 

The final consideration is that to develop a workable, safe perfonnance- 
based building code is a very difficult endeavor. Many of the prerequisites 
needed are simply not in place today. Thus, working towards the day when 
FSE-based [fire safety engineered] fire safety designs will flourish is a 
noble effort, but precipitous haste is not. The consequences of such haste 
are likely to be erection of buildings with serious fire safety shortcomings. 

(P-7) 

Snell (1993) cited opponents who argued that the adoption of performance-based designs 
would increase design complexity and cost. In Hong Kong, Lo, Lam, Yuen, and Fang 
(2003) found that building code officials there generally supported perfonnance-based 
designs but were suspect of the state of the engineering studies and analytical tools used 
to justify the method. 

Mirkah (1997a) reported a reluctance on the part of many code officials to accept 
perfonnance-based design applications because of their lack of knowledge regarding both 
complex fire behavior and sophisticated computerized fire effects modeling techniques 
often used to demonstrate that a proposed fire protection design was satisfactory to 
provide an acceptable level of safety for occupants, fire fighters, and the structure. He 
added that many code officials believed they may be vulnerable personally to tort liability 
claims should the proposed design fail with resulting deaths, injuries, or damages if the 
project did not meet the articulated requirements of a prescriptive code. Finally, Mirkah 
found a general distrust of fire protection engineers who represented a permit applicant. 
According to Mirkah, code officials were suspect that the engineers may not have been 
entirely objective since the developer is paying them. Later, Siu (2005) made the same 
finding that code officials had not obtained a comfort level with fire protection engineers 
because the discipline was relatively new compared to architecture or other engineering 
fields. 
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Finally, while Lucht et al. (2003) support the policy and cost benefits of 
perfonnance-based design, they acknowledge that “significant gaps in the data and 
knowledge base needed to support performance-based codes, engineering tools, 
predictive models, and risk assessment” remain (p. 3). 

J. LITERATURE GAPS 

Although rich and diverse sources of literature on building construction, fire 
protection, performance-based designs, fire and human behavior research, computerized 
fire modeling, federal facilities, and terrorist threats do exist, significant gaps remain in 
the literature that combines this topic into a single framework. 

First, because they do not include measurable objectives, prescriptive designs and 
codes have not been subjected to critical post-incident analysis to evaluate if they 
perfonned as the persons involved in the consensus-based development process expected 
they would. Many articles and legal cases assess the perfonnance of individual building 
components or sub-systems, or assign liability where failures occurred, but no overall 
evaluation of whether the deemed-to-satisfy approach created a safe building 
environment. Building and fire code changes that occur over time often are the consensus 
response to significant tragedy. 

Likewise, no literature assesses the post-incident perfonnance of buildings or 
facilities constructed with performance-based designs; thus, it is impossible to determine 
if the initial design objectives were met. As time passes and buildings that employed 
perfonnance-based designs suffer fires, an opportunity exists to evaluate the results. 
Given well-developed criteria, the chance to compare perfonnance-based and prescriptive 
designs also exists to determine if one is preferable to the other. 

Considering the number, size, and value of federal government real property 
assets, comprehensive studies of fire and/or arson incidents and their impact on both 
physical property and continuity of operations are in order. It is remarkable the GSA, the 
government’s largest non-military property manager, has no meaningful instrument to 
collect and analyze fire and/or arson incidents, especially since it has been more than 10 
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years since the GAO identified this shortcoming. The existing method of collecting 
incident infonnation is archaic and does not allow for detailed analysis so the GSA can 
make informed planning and construction decisions. No body of literature enables 
government policy makers to make rational, performance-based decisions on fire 
protection. 

The literature on fire modeling and design fires lacks empirical evidence on the 
impact of potential arson fire scenarios, including the use of large quantities of flammable 
liquids, multiple fire starts, and the effects of compromised fire protection systems or fire 
resistive construction. Most fire modeling is predicated on a single ignition point in a 
nonnalized (non-criminal) environment. 

Combined, these gaps show that no consensus method exists to develop threat 
scenarios against which architects or engineers can design so-called permanent 
countenneasures. This study will add to the literature by evaluating one of the 31 design 
threats developed by the ISC to suggest that quantified threat scenarios improve the 
decisions employed for the Physical Security Criteria for Federal Facilities standard. 
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III. FEDERAL FACILITY SAFETY SINCE 1995 


The means of protecting federal facilities from a variety of terrorist threats has 
evolved since a 1995 attack in Oklahoma City that killed 168 civilians, including 19 
children. Since then, the federal government has promulgated a variety of physical 
security standards intended to protect occupants, visitors, facilities, and equipment in 
existing and new buildings while increasing the government’s ability to be resilient in the 
face of attack. Most of these standards were based on prescriptive design methods, while 
more recent efforts have begun to implement perfonnance-based characteristics. This 
section reviews the recent developmental history of these federal standards. 

A. VULNERABILITY ASSESSMENT OF FEDERAL FACILITIES (1995) 

On April 19, 1995, Timothy McVeigh perpetrated a dramatic and deadly act of 
domestic terrorism when he bombed the Alfred P. Murrah federal building. The next day, 
President William J. Clinton ordered the U.S. Department of Justice (DOJ) to conduct a 
short-term study assessing the vulnerability of federal office buildings to terrorism and 
other acts of violence. Seven federal agencies participated in the study, 28 and two 
working groups (a Standards Committee and Profile Committee) 29 were created to meet 
the President’s ambitious 60-day deadline. The survey focused on the GSA-controlled 
single or multi-tenant office buildings. By October 1995, DOJ issued the 91-page 
Vulnerability Assessment of Federal Facilities (hereafter Vulnerability Assessment ) report 
that established six strategic security recommendations and created 52 recommended 
minimum-security standards for federal facilities. The recommendations were applicable 
to existing buildings, but did not include standards for new construction. 


28 The DOJ (including the U.S. Marshals Service [that served as the lead agency] and Federal Bureau 
of Investigation), the GSA, the Department of Defense, the Secret Service, the Department of State, the 
Social Security Administration, and the Administrative Office of the U.S. Courts. 

29 The Standards Committee developed minimum-security standards. The Profile Committee was 
tasked to survey sample federal facilities to determine existing security features, and identify future security 
enhancements and costs. 
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The strategic recommendations included: 1) bringing federal facilities up to 
minimum security levels concomitant with their assumed vulnerability, 2) establishing 
building security committees, 3) reemphasizing GSA’s primary responsibility for 
implementing federal facility security, 4) creating an ISC, 5) upgrading the FPS, and, 6) 
using tenant rents to cover the cost of security improvements. Elements of 
recommendations 1-4 are addressed within this study; upgrading the FPS and evaluating 
recovery costs are not. 

The study teams determined that of the one million federal civilian employees, 
about 50% worked in GSA-owned or controlled space. Almost 75% worked in what GSA 
called a “typical single or multi-tenant federal office building” (U.S. Department of 
Justice, 1995), and the DOJ report estimated 1,330 of these facilities existed in the 
continental United States. 30 The typical federal building generally was a multi-story 
building housing more than 80 employees, containing a mix of federal agencies, most of 
which had significant needs to interact unimpeded with the public. The remaining federal 
employees worked in facilities not included in the survey sample, including special use 
space, such as laboratories, national parks, nuclear facilities, military installations, or post 
offices (U.S. Department of Justice, 1995). 

According to the report, “prior to the study, there were no government-wide 
standards for security at federal facilities, and no central data base of the security 
currently in place at such facilities” (U.S. Department of Justice, 1995). This seminal 
effort focused on perimeter, 31 entry, and interior security, and security planning, which 
created a scale of five increasingly restrictive security levels. Although criminal and 
terrorist acts as a class were addressed, the term “security” was not defined in the initial 
report, nor has it been defined in subsequent reports. 

Table 4 describes the five recommended security levels and includes examples 
cited by the survey teams. The criteria are very prescriptive (e.g., number of employees 

30 During the 60-day survey, site visits were made to 1,239 locations (U.S. Department of Justice, 
1995). 

31 The report concluded perimeter security (parking, closed circuit television monitoring (CCTV), 
lighting, and physical barriers were areas outside the government’s control. 
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and building area) without any rational justification for the selected values. No 
justification exists that a building housing 149 federal employees qualifies as Security 
Level II, but one with just two more employees should increase to Security Level III, 
which is an example of prescriptive standards based on non-scientific, subjective 
decisions. 


Table 4. 

Building Security Levels: 1995 Vulnerability Assessment (After: U.S. 
Department of Justice, 1995, pp. 2-3—2-5) 

Security 

Level 

Criteria 

1 

A building that has 10 or fewer federal employees; low volume of public contact or 
contact with only a small segment of the population; and 2,500 or less square feet 
(232 m 2 ) of space, such as a small “store front” type of operation. 

II 

A building that has 11 to 150 federal employees; moderate volume of public 
contact; 2,500 to 80,000 fit 2 (232 to 7 432 m 2 ) of space; and federal activities that 
are routine in nature, similar to commercial activities. A typical Level II building 
is the Social Security Administration Office in El Dorado, Colorado. 

III 

A building with 151 to 450 federal employees; moderate/high volume of public 
contact; 80,000 to 150,000 ft 2 (7 432 to 13 935 m 2 ) of space; and tenant agencies 
that may include law enforcement agencies, court/related agencies and functions, 
and government records and archives. A typical Level III building is the Pension 
Building, a multi-tenant, historical building on 5 th Street Northwest, in 

Washington, D.C. 

IV 

A building that has 451 or more federal employees; high volume of public contact; 
more than 150,000 ft 2 (13 935 m 2 ) of space; and tenant agencies that may include 
high-risk law enforcement and intelligence agencies, courts, and judicial offices, 
child care center and highly sensitive government records. A typical Level IV 
building is the Department of Justice Building on Constitution Avenue in 
Washington, D.C., and the Alfred P. Murrah Building would have been assigned 
this category. 

V 

A building that contains mission functions critical to national security, such as the 
Pentagon or CIA Headquarters. A Level-V building should be similar to a Level- 
IV building in terms of number of employees and square footage. It should have at 
least the security features of a Level-IV building. The missions of Level-V 
buildings require that tenant agencies secure the site according to their own 
requirements. 


47 



Noticeably absent was any reference to arson as a potential threat because the 
1995 report’s contemporaneous emphasis was on mass explosive devices, which makes 
sense given the nature of McVeigh’s attack mode, and the criteria and deadline under 
which the study group was working to satisfy the President’s order. Two references 
related to fire protection occur in the report. First, as listed in Table 5, the survey teams 
found approximately 76.9% of the facilities they visited were outfitted with complete fire 
detection/suppression systems. However, the data’s validity is of concern. One problem 
with this data is that the survey instrument used does not discriminate between fire 
detection and fire suppression 32 systems so it is impossible to deduce from the data the 
number of facilities protect by fire detection, fire suppression, or both types of systems. 
Secondly, the modifier “complete” is not explained; therefore, it is impossible to 
detennine the actual extent of protection these systems provide. 


Table 5. Surveyed Facilities: Fire Protection Features (After: U.S. Department of 

Justice, 1995, p. E-32) 


Protection Level 

Facilities 

Estimated 

Percent 

Complete fire detection/suppression system covering 
all areas of the facility 

910 

76.9 

Fire detection/suppression system covers a portion of 
the facility 

196 

16.6 

No fire detection/suppression system present 

77 

6.5 

Total 

1,183 a 

100.0 


'The survey reported 1,239 site visits were conducted. No explanation was given for the data 


discrepancy. 

A second fire reference in the Vulnerability Assessment report occurs in its Appendix B, 
“Details of Recommended Security Standards,” under the category of access control with 


32 In this application, fire detection refers to electronic systems for detecting heat, smoke, or other 
combustion products, and subsequently, reporting an alarm. A fire suppression system generally implies 
automatic sprinkler systems that are heat-activated and discharge water. 
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the recommendation to “upgrade to current life safety standards: required for all facilities 
as part of GSA design requirements (e.g., fire detection, fire suppression systems, etc.)” 
(U.S. Department of Justice, 1995). 

One of the report’s recommendations was that all facilities have a fonnal 
mechanism for addressing security issues, and the responsibility for fulfillment should lie 
with a GSA-mandated and controlled Building Security Committee (BSC). The BSC 33 
would include representation from all agencies occupying the building, and the GSA 
would designate a physical security specialist 34 to assist the committee. The BSC was 
expected to evaluate and apply appropriate minimum requirements that needed to be 
implemented at its facility, as well as identify other building-specific security issues (U.S. 
Department of Justice, 1995). 

Furthennore, the 1995 report stressed the important role the GSA played in 
implementing federal facility security. By law, 35 only the Administrator of General 
Services may construct a non-military or non-postal public building, and is authorized to 
alter it by delegating that responsibility to GSA employees and agents, but the 
Vulnerability Assessment applied only to existing buildings. The Vulnerability 
Assessment recommended that the GSA should review all the BSC security enhancement 
requests, evaluate how approved requests should be amortized into tenant rents, and 
amend the GSA facility construction master planning process to assure that only 
functionally similar agencies are housed in the same location so agencies with dissimilar 
missions (e.g., law enforcement and environmental protection) are not co-located in the 
same facility (U.S. Department of Justice, 1995). 

The Vulnerability Assessment concluded that “the typical federal facility at each 
security level lacks some of the elements required to meet the new minimum standards 

33 The BSC designation eventually morphed into Facility Security Committee (FSC) in the Physical 
Security Criteria for Federal Facilities April 12, 2010 standard (p. 12). 

34 Physical security specialists develop security policy and design, develop, evaluate, and sometimes 
install protection systems and devices to insure that sensitive information, equipment, and other material is 
not compromised, sabotaged, stolen, misused, or subjected to terrorist, malicious mischief, or other acts of 
willful interference (U.S. Office of Personnel Management, 1987). 

35 See 40 U.S.C. § 3302 (2010) and 40 U.S.C. § 581 (2010). 
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proposed in this Study” (U.S. Department of Justice, 1995) and recommended that, where 
feasible, each federal facility should be brought up to the minimum standards proposed 
for its corresponding security level. The study included seven reasons for the current 
(1995) security levels. 

• GSA’s prior security levels, like most agencies before the Murrah 
Building bombing, were directed at a different kind of threat—protecting 
federal workers and visitors from theft or assault—than significant 
terrorist attacks. 

• Prior to the study, no government-wide standards existed for security at 
federal facilities, and no central database of security is currently in place at 
such facilities against which any standards could be measured. 

• Violent or terrorist threats had not been “an overriding factor in building 
design” (U.S. Department of Justice, 1995). Tight security was considered 
inimical to easy citizen access for high service levels. 

• Agencies with differing security needs often shared facility space leading 
to inconsistent application of security measures. 

• FPS security services were based on a periodic risk assessment process. 

• The typical local organizational structure was insufficient to meet tenant 

security needs, especially where multi-tenant facilities existed. No formal 
relationship existed between FPS and the tenants for conflict resolution. 

• Facility security efforts were sometimes fragmented, with different 

agencies assigned to perfonn different functions within the same facility 
(U.S. Department of Justice, 1995). 

The report recommended that because each federal building was unique—and the 
feasibility of upgrading existing conditions was dependent upon building-specific facts— 
security issues should be addressed at the building-level security committee, with follow¬ 
up analysis perfonned by the GSA. 

Most significant to this thesis, the 1995 Vulnerability Assessment report 

recommended the creation by Executive Order (EO) of an ISC to do the following. 

• Establish policies for building security, including, but not limited to, those 
recommended in the study 

• Develop a strategy for ensuring compliance with approved standards 

• Oversee the implementation of appropriate security measures in federal 
buildings 


50 



In addition, the ISC would encourage interagency cooperation on security issues, 
assess technology as a means of providing cost-effective security enhancements, assist in 
budgeting oversight to prioritize federal security needs, develop long-term construction 
standards for these locations with threat levels or missions that require blast-resistant 
structures, evaluate standards for the location of—and special security related to—day 
care centers in federal facilities, 36 and assist the GSA in developing and maintaining a 
centralized security database (U.S. Department of Justice, 1995). The Vulnerability 
Assessment report remained in effect until it was superseded by the April 12, 2010 
issuance of the Physical Security Criteria for Federal Facilities, discussed later in this 
section. 


By 1998, Peck, in testimony before the Subcommittee on Public Buildings and 
Economic Development of the House Committee on Transportation and Infrastructure, 
reported that 90% of the estimated 8,000 identified security upgrades in 8,300 GSA 
controlled buildings had been made, and 75% of the recommended countermeasures had 
been completed (Peck, 1998). However, a 1998 report from the General Accounting 
Office was critical of the GSA’s progress on meeting its performance goals, and that the 
security improvements program had at least three significant flaws. 

GSA has not established several key program evaluation mechanisms for 
its building security program that could assist it in detennining how 
effective its security program has been in reducing or mitigating building 
security risks or in shaping new security program initiatives. These 
features are (1) specific goals, outcomes, and performance indicators for 
the security program, such as reducing the number of thefts or 
unauthorized entries; (2) establishing and implementing systematic 
security program evaluations that would provide feedback on how well the 
security program is achieving its objectives and contributing to GSA’s 
strategic goals; and (3) ensuring that a reliable perfonnance data 
information system is place. (Ungar, 1998) 


36 Following the deaths of 19 children under the age of six in the Alfred P. Murrah Building bombing, 
the sensitive nature of childcare centers located in federal facilities required additional special attention. 
Any facility with a childcare center automatically received a facility population score of “very high.” 
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Ungar’s testimony introduced the concept of perfonnance-based methods for 
building security. Terms, such as “specific goals, outcomes, and performance indicators,” 
and “achieving objectives,” move from the prescriptive approach to developing design 
solutions that can produce measurable results. Ungar further suggested that revisions in 
the building risk assessment methods—and simultaneous resumption of the FPS’s 
periodic risk assessments—would provide a means to analyze the effectiveness of the 
adopted security measures and whether they would continue to be appropriate for future 
threats that may arise (Ungar, 1998). 

B. CREATION OF THE INTERAGENCY SECURITY COMMITTEE (1995) 

On October 19, 1995, President Clinton issued Executive Order E012977, which 
established a permanent ISC within the executive branch to address continuing 
government-wide security for federal facilities (Smith, 2007). In language nearly 
identical to that recommended in the Vulnerability Assessment report, the ISC was 
chartered to establish policies for security and protection of federal facilities, develop and 
evaluate security standards for federal facilities, develop a strategy for ensuring 
compliance with such standards, and oversee the implementation of appropriate security 
measures in federal facilities. The ISC was authorized to do the following. 

• Encourage agencies with security responsibilities to share security-related 
intelligence in a timely and cooperative manner 

• Assess technology and information systems as a means of providing cost- 
effective improvements to security in federal facilities 

• Develop long-tenn construction standards for those locations with threat 
levels or missions that require blast resistant structures or other specialized 
security requirements 

• Evaluate standards for the location of, and special security related to, day 
care centers in federal facilities 

• Assist the General Services Administrator in developing and maintaining a 
centralized security database of all federal facilities (Clinton, 1995) 

Table 6 identifies the member agencies and representatives of the original ISC 
chaired by the GSA director. 
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Table 6. Original ISC Representation (After: “Executive Order 12977,” 1995) 


Department of Justice 

Department of the Treasury 

Department of Commerce 

Department of the Interior 

Department of Housing and Urban Development 

Department of Labor 

Environmental Protection Agency 

Department of Transportation 

Office of Management and Budget 

Department of Veterans Affairs 

Department of Agriculture 

Department of State 

Department of Health and Human Services 

Department of Education 

Director, United States Marshals Service 

Department of Defense 

Director, Security Policy Board 

Central Intelligence Agency 

Assistant to the President: National Security Affairs 

Department of Energy 

Assistant Commissioner of the Federal Protective 
Service of the Public Buildings Service 

GSA 

The ISC created four working groups to 

distribute work and accomplish its 

charter. Table 7 summarizes the assignments each committee was given within the ISC’s 

overall framework. 


Table 7. ISC Working Groups (After: Holt, 2010) 

Working Group 

Assignment 


Provided overall project guidance, established priorities, 
recommended specific projects and initiatives. 

Coordinated development and review of all ISC physical 
security standards. 

Identified best practices in security technology and 
provided guidance on cost-effective use of new 
technology to supplement and reinforce other security 
measures. 

Provided subject-matter expertise on best practices in 
providing agencies with mechanisms to support security 
programs, while integrating information management 
controls through a collaborative effort. 


Steering Subcommittee 


Standards Subcommittee 


Technology Best 
Practices Subcommittee 


Convergence Subcommittee 
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C. GSA SECURITY CRITERIA (1997) 

In January 1997, the GSA completed its first draft of a document entitled GSA 
Security Criteria, which was revised and issued on October 8, 1997, to establish design 
standards for the protection of federal employees in new, significantly renovated, and 
long-term leased civilian facilities (U.S. General Services Administration, 1997). 
Nationally critical Level V facilities, defined in Table 3, were outside the scope of the 
new standard. The GSA document attempted to integrate security requirements 
throughout all functional and design phases of the building process, including site and 
interior space planning, as well as structural and electrical design elements (Smith, 2007). 

While sensitive to the earlier DOJ criteria of Building Security Levels, the GSA 
approach included a mix of other categories beyond building size and population, which 
introduced value-laden criteria, such as symbolism, mission criticality, consequences of 
attacks, and threat vulnerabilities. Table 8 summarizes the categories and criteria. 


Table 8. Categories and Criteria (From: U.S. General Services Administration, 1997) 

_ Category _ Criteria _ 

Any thing or place for which a popular recognition exists of an 
object, name, or governmental activity by virtue of its historic 
Symbolic significance, its size, its uniqueness, or its context with specific ideas 

or sets of values or attitudes. 


Degree to which a building houses operations and functions critical 
Mission criticality to national interests of the United States. 

Impact of an attack on a facility, including injuries and the loss of 
life; damage to the property or assets; interruption of the work done 
Consequence at the facility; and the time needed to repair, replace, or bypass the 
building to continue the work. 


Manifested effects of a criminal or criminal-like event that would 
involve the loss of life or the causation of injuries at to-be-defined 
levels. May also be the loss of, or damages to, tangible or intangible 
High consequences assets or the loss of irreplaceable assets and resources, all of which 
have significant worth on a national scale, and not limited to 
monetary considerations. 
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Category _ Criteria _ 

Terrorist threats, including bombs, chemical attacks, and biological 
Threat attacks, or crime threats, based on local crime indexes. 

Threat information authenticated by an official intelligence or law 
enforcement agency based on highly trusted sources or methods, and 
Verified threat included information that a specific location or agency will be 
attacked within a contemporary time frame. 


Abandoning the DOJ Vulnerability Assessment Levels I through V, the GSA 
created its own alphabetical list of four protection levels intended to be combined with 
threat and risk analyses to provide an assessment framework to measure the extent and 
cost of security features based on potential criminal or terrorist threats. Table 9 
summarizes the GSA protection levels. Table 10 describes the crime or threat levels 
detennined to exist where the facility would be constructed. 


Table 9. GSA Protection Levels: 1997 (After: U.S. General Services Administration, 

1997) 


Protection 

Level 


D 


Application 

When a building element 3 or building needs a high level of protection that would 
tend to be used when a building is a national symbol or of critical importance; 
and when its damage or loss will have high consequences, and when a verified 
high threat exists. 


When a building element or building needs a medium-to-high level of protection 
that would tend to be used when a building is a regional symbol or has a 
C significant impact on the government’s mission, and when its damage or loss 

will have high consequences; and when a verified threat exists. 


When a building element or building needs a medium-to-low level of protection. 
This level would tend to be used when the building is a regional symbol or has 
B an impact on the government’s mission, and when its damage or loss will have 

moderate consequences; and when a suspected threat exists. 


When the building element or building does not need higher protection. This 
A level would tend to be used when the building is of low consequence and when 

an unknown threat exists. 


“Building elements includes foundations, structural framing, exterior and interior walls, roofs, and internal 
systems, such as heating, ventilation, air conditioning, electrical, plumbing, and fire protection systems. 
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Table 10. 

Protection Level and Crime/Terrorist Threat Levels (After: U.S. General 
Services Administration, 1997) 

Protection 

Level 

Crime/Terrorist Threat Levels 

D 

When a high local crime index exists , 37 when the building houses critical 
operations, or when it has high asset value. 

C 

When a medium local crime index exists, when the building houses 
sensitive operations, or when it has moderate asset value. 

B 

When a low local crime index exists, when the building houses routine 
operations, or when it has low asset value. 

A 

When the facility is small and has a very low local crime index, when the 
building houses routine operations, and when it has very low asset value. 

N/A 

Not applicable. 


Using the characteristics described in Tables 8 and 9, design professionals could 
develop a matrix of protection levels for the various elements that comprise the 
construction, sub-systems, 38 and security operations of a federal facility. The first step in 
the analysis was to conduct a security assessment categorizing the facility for criminal 
and terrorist threats using guidance from the two tables. Then, a panel of security, blast, 
intelligence, and technical experts were expected to review the results to “ensure the 
application of appropriate and cost-effective security measures, and give the design team 
building-specific security criteria to work with” (U.S. General Services Administration, 
1997, p. 5). The resulting matrix allowed that a facility might have different performance 
categories applied to each of its building systems so the highest threat level across any 
row of cells dictated the minimum protection level for the building element. 


33 Index crimes are the eight crimes the FBI combines to produce its annual crime index. These 
offenses include willful homicide, forcible rape, robbery, burglary, aggravated assault, larceny over $50, 
motor vehicle theft, and arson (Federal Bureau of Investigation, 2002). 

38 Including mechanical, electrical, plumbing, conveyance, heating, ventilation, air conditioning, and 
fire protection systems. 
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Figure 1 is a matrix of the results for a hypothetical building where intelligence 
and security analysts provide guidance from Table 10 that the specific building is 
identified as being in a neighborhood with a very low local crime index (Protection Level 
A). However, evidence exists of a limited bomb threat (Protection Level B), a verified 
biological threat of moderate consequence (Protection Level C), and a verified chemical 
threat of high consequence (Protection Level D). The left vertical axis labeled “Building 
Element” includes some of the components that comprises the construction and operation 
of a building. While not clearly articulated in the descriptors, fire protection features, 
such as fire resistant construction, or automatic fire suppression systems, typically could 
appear in one or more of the categories, such as building facade and interior walls (as fire 
resistant construction), and mechanical systems, electrical systems, and security systems 
(as fire detection or suppression systems). The category security operations is neither 
clearly defined nor explained in the report. From the text, it appears to include human 
elements, such as guard and employee training, operations plans, and emergency plans, 
and therefore, is not included in this analysis of the built environment. 

In this hypothetical example, the threats to the first three items (mechanical 
systems, windows, and security systems), range left-to-right from low to high (A to D), 39 
and since the high consequence threat from chemical attack is rated D, the protection 
level for those particular building elements must meet Level D, a so-called “high level of 
protection” (from Table 9) but still does not specify how the elements should perform 
when subject to an attack. For comparison, the highest level of protection for stand-off 
distance, building facades, interior walls, or electrical systems only reaches Protection 
Level B. 


39 The protection of mechanical systems is not applicable to criminal threats in this assessment 
method. 
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Building Element 

Crime 

Threats 

Bomb Biological 

System Protection 
Level 

Chemical 

Mechanical systems 

N/A a 

B 

C 

D 

D 

Windows 

A 

B 

C 

D 

D 

Security systems 

A 

B 

C 

D 

D 

Stand-off distance 

A 

B 

N/A 

N/A 

B 

Building fa£ade 

A 

B 

N/A 

N/A 

B 

Interior walls 

N/A 

B 

N/A 

N/A 

B 

Electrical systems 

A 

B 

N/A 

N/A 

B 

Security operations 

A 

B 

C 

D 

D 


a Not applicable. 

Figure 1. Hypothetical Federal Facility Protection Level Assessment (After: U.S. 

General Services Administration, 1997) 


Once the system protection level was established, designers were expected to find 
“corresponding protective measures in the engineering criteria” included in the GSA 
Security Criteria 40 document (U.S. General Services Administration, 1997). However, 
the engineering criteria were vague, and generally included prescriptive requirements. 
For example, the reference to protecting fire protection water supplies provides 
unjustified prescriptive dimensions from high threat areas, 

The fire protection water system should be protected from single point 
failure in case of a blast. The incoming line should be encased or buried, 
or located 50’ away from high threat areas such as loading docks, front 
entrances, and parking, and the interior mains should be looped and 
sectionalized. (U.S. General Services Administration, 1997, p. 66) 


40 In deference to the political and emotional sensitivity of childcare centers after the Murrah Building 
bombing, the report included these prescriptive requirements: “Child care centers may be located anywhere 
in low risk buildings. In medium to high-risk buildings and courthouses, they should not be within 100 feet 
from the main public entrance or a loading dock. They should also be placed 100 feet away from public 
parking unless there are compensating blast design measures” (U.S. General Services Administration, 

1997, pp. 7-8). 
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The design intent of a performance-based engineered approach is clear; protect 
the system from a single point failure in case of a blast. However, the size and nature of 
the potential blast and its distance from the fire protection water system is not specified; 
therefore, it is impossible for a designer to develop perfonnance criteria to comply with 
this requirement. Conversely, the arbitrary prescriptive requirement to encase, bury, or 
locate the supply 50 feet (15 m) from one or more parts of a building cannot be justified 
without a combined analysis of the site, soil conditions, building configuration, or threat. 

D. ISC SECURITY DESIGN CRITERIA FOR NEW FEDERAL OFFICE 

BUILDINGS AND MAJOR MODERNIZATION PROJECTS (2001) 

The GSA and the U.S. Department of State convened a symposium in November 
1999 to discuss the “apparently conflicting objectives of providing security from terrorist 
attack while designing public buildings in an open society” (Knoop et ah, 2001). The 
GSA and State rejected the idea that rigid, prescriptive design approaches provided the 
solution to the security/openness paradox and “challenged the design and security 
professions to find aesthetically appealing architectural solutions that achieve both 
security and physical protection; a balanced, performance-based approach to security 
[emphasis added] and openness” (Knoop et ah, 2001, p. 2). With this challenge, the GSA 
and State opened the door to the performance-based design approach in federal facilities 
where security issues were concerned. 

In May 2001, the ISC issued new guidance, the Security Design Criteria for New 
Federal Office Buildings and Major Modernization Projects (ISC Security Criteria), 
based on the five security levels for federal facilities developed in the 1995 Vulnerability 
Assessment report. It did not include the more subjective criteria described in the GSA 
Security Criteria (1997) (see Tables 8 and 9). 

According to Smith (2007), new ISC security requirements for construction 
projects strongly emphasized protection from explosives used in terrorist attacks. The 
new ISC requirements included the use of glazing protection to enhance blast-resistance 
for windows, the establishment of distances that buildings should be set back from the 
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street (called set-back or stand-off distances), vehicular access control to buildings, and 
the placement of air handling intakes to prevent the introduction of airborne 
contaminants. Two draft documents, one that addressed entry security technology, and 
the second, which pertained to preparedness for nuclear, biological, and chemical attacks, 
were not issued officially by the ISC membership (Smith, 2007). 

The Office of the Chief Architect of the Public Buildings Service (an office 
within the GSA) asked the National Research Council (NRC) to establish a panel of 
design and construction experts to evaluate the criteria to detennine if they “might be too 
prescriptive to allow a design professional ‘reasonable flexibility’ in achieving desired 
security and physical protection objectives” (Knoop et ah, 2001, p. 2). The resulting 
Committee to Review the Security Design Criteria of the ISC comprised representatives 
from the disciplines of architecture, structural and fire protection engineering, blast- 
effects mitigation, physical security, and risk analysis and management. 

The Committee to Review the Security Design Criteria (Review Committee) was 
critical of the 2001 ISC Security Criteria. 

The document in general appears to be a mix of performance objectives, 
prescriptive requirements, and references to industry standard designs. The 
committee believes that although full implementation of all the ISC 
criteria will provide some protection for building occupants against most 
blast-resistant threats and should significantly reduce injuries, the 
organization of the document makes it difficult to identify clearly the 
connections between the specific criteria and the perfonnance objectives 
they are meant to achieve. It is also difficult to identify clearly how some 
criteria apply to specific components of building design. Because this is a 
critical element on a performance-based design process, the committee 
believes that rectifying this shortcoming should be given priority. (Knoop 
et ah, 2001, p. 2) 

Using the ICC’s 2001 edition of the International Performance Code for 
Buildings and Facilities as a model, the Review Committee outlined how a performance- 
based design approach could be used to achieve the desired security and safety concerns 
while maintaining open access to employees and the public. The Review Committee also 
pointed out, however, “the document is also focused on the terrorist vehicle bomb as the 
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primary means of attack; there is little guidance on defending federal buildings and their 
occupants from chemical, biological, or radiological weapons” (Knoop et ah, 2001, p. 
41). Likewise, arson or fire threats were relegated to the category of naturally occurring 
hazards and were mentioned rarely. Without addressing these and other threats, the 
Review Committee reported, the outcome could result in “building perfonnance not 
being considered comprehensively—for instance, failure to design for survivability of 
fire protection systems after a bomb attack could result in an otherwise avoidable post¬ 
attack fire” (Knoop et ah, 2001, p. 41). 

While encouraging greater reliance on performance-based design to meet a 
variety of security challenges, the Review Committee acknowledged a role for 
prescriptive design and improvements in design guidance remained. 

The continued use of both prescriptive and performance criteria is 
appropriate for several reasons, including the fact that in much of the 
building design process using prescriptive criteria need not limit creative 
design. Perfonnance analysis and design are only needed for certain 
portions of the process, for example, the design of glazing to satisfy a 
unique threat or location. Structured appropriately, prescriptive criteria can 
be a means of meeting performance objectives. However, the ISC Security 
Criteria do not provide guidance on the amount and completeness of 
information to be provided in documenting a perfonnance-based security 
design. (Knoop et ah, 2001, p. 42) 

The Review Committee issued a set of 13 short- and long-term recommendations 
to improve the implementation of the ISC Security Criteria while simultaneously 
enhancing security. One included encouraging the ISC and its member agencies to begin 
a comprehensive and timely review of the ISC Security Criteria to include the “creation 
of risk assessment and management tools as well as policy guidance for physical 
protection and security to guide the development of risk reduction strategies and a 
performance-based design process” (Knoop et ah, 2001, p. 46). 
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E. BUILDING SECURITY: ISC HAS HAD LIMITED SUCCESS IN 
FULFILLING ITS RESPONSIBILITIES (U.S. GENERAL ACCOUNTING 
OFFICE, 2002) 

Meanwhile, the GSA conducted an independent review of the ISC, and reported 
the interagency group had made little progress on some of its assigned responsibilities. 
While acknowledging the ISC had developed and issued security design criteria and 
minimum standards for building access procedures, and served as a forum for its working 
groups to discuss security related issues: 

it had made little or no progress in other elements of its responsibilities, 
such as developing and establishing policies for security in and protection 
of federal facilities, developing a strategy for ensuring compliance with 
security standards, overseeing the implementation of appropriate security 
in federal facilities and developing a centralized security database of all 
federal facilities. (U.S. General Accounting Office, 2002) 

The GAO report reemphasized the NRC Review Committee’s findings that the 
ISC lacks “performance goals and measures” (U.S. General Accounting Office, 2002, 
p. 16). The GAO blamed the shortcomings on a lack of consistent and aggressive 
leadership in the General Services Administration, inadequate staff support and funding 
for the ISC, and ISC’s own difficulty in making decisions. The GAO acknowledged the 
GSA was taking steps to correct the problems. Since the GAO report was produced at the 
time Congress was considering creation of the DHS, the GAO recommended that the 
Director of the Office of Management and Budget 41 work with the DHS, the GSA and 
other entities to address the report’s recommendations with whichever agency assumed 
responsibility for protecting federal facilities. Additionally, the GAO report suggested 
that during its deliberations, Congress considers clarifying the proposed DHS’s 
jurisdiction on security-specific matters for federal facilities among the agencies that 
eventually would become DHS components. 


41 At the time, the Office of Management and Budget was both represented on the ISC and responsible 
for heading the government’s efforts to establish the DHS (U.S. General Accounting Office, 2002). 
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After the passage of the Homeland Security Act 42 and the eventual creation of the 
DHS, the chainnanship of the ISC was transferred from the GSA Administrator to the 
Secretary of the DHS and a GSA representative was added to the ISC’s membership. 
Within the DHS, the ISC chairmanship subsequently was delegated to the director of the 
FPS (Smith, 2007). 

F. ISC SECURITY STANDARDS FOR LEASED SPACE (2004) 

Following the issuance of the 1995 Vulnerability Assessment, some agencies 
reported that the standards guidance was not suitable for most locations that the federal 
government leased, and the result was an apparent double standard for facilities leased or 
owned. The DHS reported that: 

providing the level of security control, access control, guard service, 
magnetometers, garage control, setbacks, etc. recommended by the DOJ 
study and attainable in a federally owned location, is not easily attainable 
in the typical 10,000 square-foot lease [929 m 2 ]. (U.S. Department of 
Homeland Security, 2004, p. 3) 

In response to these concerns, the ISC created a Lease Security Subcommittee to 
develop a separate set of standards for leased properties. The standards relied on four of 
the five security levels 43 recommended in the 1995 assessment, but were modified for the 
needs of leased spaces where real property improvements were under the control of the 
property owner, not the tenant. Major structural changes, facade reconstruction, interior 
improvements, and blast protection were limited; however, all Level II through IV leased 
spaces were required to install shatter-resistant material on exterior windows to reduce 
the threat of flying shards resulting from a perimeter explosion. The security standards 
for leased space were issued September 29, 2004. Meanwhile, an updated version of 2001 
Security Design Criteria for New Federal Office Buildings and Major Modernization 
Projects was approved by the ISC membership the same day. 

42 Public Law 107-296, 116 Stat. 745, enacted November 25, 2002. 

43 While the 1995 Vulnerability Assessment included five levels, the highest (Level V) was applicable 
only to highly secured facilities with a national security mission, which was not likely found in a leased 
commercial space. 
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G. HOMELAND SECURITY: FURTHER ACTIONS NEEDED TO 
COORDINATE FEDERAL AGENCIES’ FACILITY PROTECTION 
EFFORTS AND PROMOTE KEY PRACTICES (U.S. GOVERNMENT 
ACCOUNTABILITY OFFICE, 2004) 


In 2004, the GAO produced an analysis of ISC performance to date for the U.S. 
House of Representatives Committee on Government Refonn. The report indicated while 
the ISC had made progress in federal facility protection efforts, it still fell short in several 
key areas including planning, the development of goals and objectives, and coordination 
among federal agencies required to meet ISC standards (U.S. Government Accountability 
Office, 2004). 

The GAO report, Homeland Security: Further Actions Needed to Coordinate 
Federal Agencies ’ Facility Protection Efforts and Promote Key Practices, identified six 
key practices that together could enable federal agencies to obtain a more comprehensive 
approach to physical security. Table 11 summarizes the six key practices and the 
descriptions provided in the GAO study. 


Table 11. Key Practices in Facility Protection (After: U.S. Government Accountability 

Office, 2004) 

_ Key Practice _ Description _ 


Allocating resources 
using risk management 


Leveraging technology 


Information sharing 
and coordination 


Performance measurement 
and testing 


Identify threats, assess vulnerabilities, and determine 
critical assets to protect and use information on these and 
other elements to allocate resources as conditions change. 

Leverage technologies to enhance facility security through 
methods like access control, detection and surveillance 
systems. 

Establish means of coordinating and sharing security and 
threat information with other government entities and the 
private sector. 

Use metrics to assure accountability for achieving program 
goals and improve security at facilities. 


64 



Key Practice 

Description 

Aligning assets to mission 

Align assets to mission and relocate staff to reduce 
vulnerabilities, to the extent agencies have excess and/or 
underutilized facilities. 

Strategic management of 
human capital 

Strategically manage human capital to maximize 
government performance and assure accountability in 
facility protection. 


The GAO found during the course of its study a number of federal agencies had 
begun using one or more of the key practices in assessing and improving their facility 
protection, but systemic problems still existed including “developing quality data that 
form the basis for risk management, ensuring that technology will perform as expected, 
and determining how to measure the true impact that various approaches have on 
improving protection” (U.S. Government Accountability Office, 2004, p. 5). This 
conclusion emphasized the value of performance-based methods in facility security 
design because it allowed designers and tenants to address articulated risks and select 
from a variety of engineered solutions to improve protection. Two of the key practices 
identified in Table 11 are directly related to the precepts of performance-based design, 
allocating resources using risk management, and performance management and testing 
using metrics to assure accountability in design outcomes. 

Regarding the application of risk management principles to facility security, the 
GAO report commented that in general while they can “take on various forms, our past 
work showed that most risk management approaches generally involve identifying 
potential threats, assessing vulnerabilities, identifying the assets that are most critical to 
protect in terms of mission and significance, and evaluating mitigation alternatives for 
their likely effect on risk and their cost” (U.S. Government Accountability Office, 2004). 
This comment captures the key characteristics of performance-based design, identify one 
or more problems, and develop design solutions to address them. 

The GAO in 2006 published another report generally critical of the fact no 
government-wide guidance nor standard existed that agencies could use to measure the 
perfonnance of their facility protection efforts (U.S. Government Accountability Office, 
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2006). The Government Performance and Results Act of 1993 (GPRA) required program 
perfonnance measurements in federal agencies. 44 The GAO studied public- and private- 
sector entities in the United States, Australia, Canada and the UK to determine how they 
developed physical security perfonnance measures. In response, the ISC implemented its 
own set of perfonnance measures for security improvements with the 2009 publication of 
the Interagency Security Committee Use of Physical Security Performance Measures. 

While the focus of the document was on the effective use of financial resources 
primarily to satisfy the GPRA, the report did contextually acknowledge the value of 
perfonnance-based approaches as part of an overall security strategy. 

Without effective performance measurement data, the GAO said decision 
makers may not have sufficient information to evaluate whether their 
investments have improved security, reduced Federal facilities’ 
vulnerability, and reduced the level of risk to an acceptable level. (U.S. 
Department of Homeland Security, 2009) 

The conclusion that resources cannot be managed properly without effective 
performance measures is equally important to the physical security design professional. 
When objective measures regarding the performance of security countenneasures are 
provided, the design professional can develop realistic solutions that address the specific 
threat. 

H. FACILITY SECURITY LEVEL (FSL) DETERMINA TIONS FOR FEDERAL 
FACILITIES (2008) 

In 2006, the ISC elected to update the building security level criteria published in 
the 1995 vulnerability study and remained unchanged in the subsequent years. An 
Existing Facilities Security Standards Working Group was established to review and 
update the standards in light of newly identified threats, such as those posed in the 
September 11, 2001, aircraft attacks on the World Trade Center and the Pentagon where 
fires subsequent to the aircraft impact resulted in substantial deaths, injuries, and damage. 
The working group developed a 16-page standard, published in 2008, that defined the 

44 Public Law No. 103-62, 107 Slat. 285, enacted August 3, 1993. 
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criteria and process a BSC should use to determine its facility security level based on 
mission criticality, facility symbolism, population, size, and perceived threat to tenant 
agencies. The standard was built upon the five security levels identified in the 1995 
vulnerability assessment (Table 4) and modified subjective criteria borrowed, in part, 
from the 1997 GSA Security Level Criteria (Table 8). 

Table 12 summarizes the latest ISC security level criteria modified from the DOJ 
and GSA models. While the categories mission criticality, symbolism, and threat remain 
similar to the 1997 GSA Security Level Criteria, consequence, high consequences, and 
verified threat were deleted. Facility population and facility size (borrowed from the DOJ 
1995 vulnerability assessment) were substituted, and a new category “intangible factors” 
was added. 


Table 12. ISC FSL Criteria (After: U.S. Department of Homeland Security 2008) 

Category _ Criteria _ 

Facility mission, particularly as it may relate to national essential 
Mission criticality functions 45 and other important business of the government. 

External appearances or well-known/publicized operations within the 
facility that indicate it is a federal facility, and the potential negative 
Symbolism psychological impact of an undesirable event occurring at a prominent 

federal facility. 


Facility 

population 


Facility size 


Peak total number of personnel in government space, including employees, 
onsite contract employees, and regular visitors. 

Square footage of all federally occupied space in the facility, including 
cases in which an agency with real property authority controls some other 
amount of space in the facility. 


Tenant agency 
threat 


Nature of public contact required in or resulting from the conduct of 
business is adversarial, or whether a history of adversarial acts committed 
at the facility, against facility tenants, or against the tenant agencies 
elsewhere existed. 


45 National essential functions are “that subset of essential functions that are necessary to lead and 
sustain the Nation during a catastrophic emergency, and that, therefore, must be supported through the 
Continuity of Operations (COOP) and the Continuity of Government (COG) capabilities” (U.S. 
Department of Homeland Security, 2008, p. 2). 
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Category 

Criteria 

Intangible factors 

Reduced value of the facility and a corresponding reduction in the 
consequences of its loss, including potential for cascading effects or 
downstream impacts on interdependent infrastructure, or costs associated 
with the reconstitution of the facility. 


The Facility Security Level Determinations for Federal Facilities—An 
Interagency Security Committee Standard retained some of the criteria from the 1995 
vulnerability assessment. Federal properties be assessed periodically 46 and be assigned a 
FSL ranging from I (low risk) to IV (very high). Some facilities, because of mission 
criticality, uniqueness or symbolism, might warrant a special FSL V designation (U.S. 
Department of Homeland Security, 2008; U.S. Department of Homeland Security, 
2010c). 

Figure 2 represents the FSL determination matrix included in the revised standard. 
Using the matrix, points are assigned by the BSC based on its assessment of the factors 
that “make the facility a target for adversarial acts (threats), as well as those that 
characterize the value or criticality of the facility (consequences)” (U.S. Department of 
Homeland Security, 2008; U.S. Department of Homeland Security, 2010c). The sum of 
the assigned points established the preliminary FSL designation (Table 13); however, the 
FSL could be adjusted one level by the BSC’s assessment of the “intangible factors.” The 
“intangible factors” and any adjustments to the facility level score had to be justified by 
the BSC. 


46 According to the standard, security assessments for Level 1 and It facilities were to occur every five 
years, and every three years for Level III, IV and V facilities (U.S. Department of Homeland Security, 
2008; U.S. Department of Homeland Security, 2010c). 
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Points 

Factor 

1 

2 

3 

4 

Score 

Mission 

criticality 

Low 

Medium 

High 

Very High 


Symbolism 

Low 

Medium 

High 

Very High 


Facility 

Population 

<100 

101-250 

251-750 

>750 


Facility 

size 

<10,000 ft 2 

10,001-100,000 ft 2 

100,001-250,000 ft 2 

>250,000 ft 2 



< 929 m 2 

929-9 290 m 2 

9 290-23 226 m 2 

> 23 226 nf 


Threat to 

Tenant 

Agencies 

Low 

Medium 

High 

Very High 







Sum of Above 

Facility 

Security 

Level 

I 

5-7 points 

II 

8-12 points 

III 

13-17 points 

IV 

18-20 points 

Preliminary 

FSL 

Intangible 

adjustment 

Justification 

+/-1 FSL 

Final FSL 


Figure 2. ISC FSL Determination Matrix (After: U.S. Department of Homeland 

Security, 2008) 


Table 13. Point Value-Derived FSL (After: U.S. Department of Homeland Security, 

2008) 


Total Points 

Facility Security Level 

5-7 

I 

8-12 

II 

13-17 

III 

18-20 

IV 


The Facility Security Level Determinations for Federal Facilities—An 
Interagency Security Committee Standard made no recommendations regarding physical 
security construction, threat mitigation, or countermeasures. The BSC was required to 
either accept the risk it identified, or fund security measures to reduce the risk (U.S. 
Department of Homeland Security, 2008; U.S. Department of Homeland Security, 
2010c). 


69 






















Not surprisingly, given the broad and mostly subjective latitude with which BSCs 
could evaluate their facilities, Smith found “the successful integration of the federal 
government’s facility protection standards is a fonnidable challenge because it involves 
diverse agencies with varying perspectives on security issues” (Smith, 2007). A 
perfonnance-based approach to security issues would enable these diverse agencies to 
identify their unique security challenges and address them with customized solutions. 

I. PHYSICAL SECURITY CRITERIA FOR FEDERAL FACILITIES (2010) 

On April 12, 2010, the ISC released the complementary documents the Physical 
Security Criteria for Federal Facilities standard and the DBT report. 47 Both were subject 
to a 24-month validation period before they were finalized. In accordance with the 
recommendations from the 2004 GAO report, 48 the Physical Security Criteria for 
Federal Facilities standard adopted a risk management approach to aid in identifying 
threats, assessing vulnerabilities, determining critical assets needing protection, adjusting 
resources as threat conditions changed, and, key to this study, selecting countermeasures 
to address threats and vulnerabilities. Using a 13-step decision point flowchart model 
(Figure 3) and several tables of anticipated threats and security design options, the 
Physical Security Criteria for Federal Facilities describes a process that officials can use 
to determine the security measures needed at a federal facility (U.S. Department of 
Homeland Security, 2010c). The new document replaces the 1995 Vulnerability 
Assessment, the ISC Security Standards for Leased Space, and the ISC Security Design 
Criteria for New Federal Office Buildings and Major Modernization Projects, which 
consolidated them into a single document. The standard is applicable to “existing 
buildings, new construction, or major modernizations; facilities owned, to be purchased, 
or leased; stand-alone facilities, Federal campuses, and where appropriate; individual 


47 The DBT subsequently was updated November 30, 2010. 

48 Homeland Security: Further Actions Needed to Coordinate Federal Agencies’ Facility Protection 
Efforts and Promote Key Practices. 
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facilities on Federal campuses; and special-use facilities” 49 (U.S. Department of 
Homeland Security, 2010c, p. 4). 

Application of the new standard is predicated on the FSL designation utilizing the 
assessment methods found in the 2008 standard (Figure 2). Once a security assessment is 
conducted by the agency or component responsible for physical security at the site, the 
FSC assigns the building or facility a baseline level of protection (LOP) score, which is 
“the degree of security provided by a particular countermeasure or set of counter 
measures” (U.S. Department of Homeland Security, 2010c, p. 7). The FSL (ranked I-IV) 
becomes the foundation for decision making using the ISC Risk Management Process 
identified in Figure 3. This fonnalized risk management process provides the FSC a 
series of decision points where the committee may evaluate its security features to 
balance the LOP against the perceived risk. 

It is important to understand the word “risk” and its use in the Physical Security 
Criteria for Federal Facilities ’ narrative. According to the document, risk is a “measure 
of the potential hann from an undesirable event that encompasses threat, vulnerability, 
and consequence” (p. 7). In this context, it implies that hann will occur and can be 
quantified. This perspective is similar Purdy’s findings (2010) that “it has been common 
for risk to be regarded solely as a negative that organizations should try to avoid or 
transfer to others” (p. 882). The International Organization for Standardization (ISO) has 
developed a consensus definition of risk ideally suited to both the Physical Security 
Criteria for Federal Facilities and the application of performance-based design to 
minimize the consequences of unwanted events. In the new ISO definition, risk is the 
“effect of uncertainty on objectives” (p. 882). In this context, no negative connotation 
exists, only that the anticipated results might be altered by outside influences; therefore, 
risk may be positive or negative. 


49 Example of special use facilities "include but are not limited to, high-security laboratories, 
hospitals, aircraft and spacecraft hangers , or unique storage facilities designed specifically for such things 
as chemicals and explosives” (U.S. Department of Homeland Security, 2010c, p. 14). By the nature of their 
use and contents, these facilities tend to be a high fire risk or an arson target. 
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In the ISC model, once the FSL is assigned and the baseline LOP established, the 
risk management process requires an identification and assessment of threats to the 
facility (Step 2). To aid the security organization’s assessment process, a threat list of 29 
euphemistically named “undesirable events” was included in the original document 
intended to provide a “conceptual scenario for use in identifying applicable 
countenneasures when applying this Standard” (U.S. Department of Homeland Security, 
2010c, p. 72). 50 The security analysis is required to assess all the undesirable events on 
the list. Event scenarios ranged from ballistic attacks using a variety of weapons to 
robbery, theft, and unauthorized surreptitious entry to the premises. One postulated arson 
scenario is “an attack against a Government facility by knowingly and willingly setting a 
fire with intent to cause damage or destruction to the facility and/or physical injury or 
loss of life to the occupants” (U.S. Department of Homeland Security, 2010c, p. 72). 


50 A later version of the DBT increases this list to 31. 
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FSL 

Determination 


Step 1 

Identify baseline 
Level of Protection 


Step 2 

Identify and assess risks 


Evaluate alternate locations 


Step 3 
Risks = 
baseline 


Step 4 

Determine LOP needed 
to meet risk 


Maintain existing 
LOP 


Step 5 

Existing LOP 
sufficient? 


Step 6 
Necessary 
LOP 

achievable? 


Step 7 

Determine highest 
achievable LOP 


Step 8 
Risk 

acceDtable? 


Step 9 
Alternate 
locations 
available? 


Plan for delayed 

NO 

implementation 

«-< 


Step 11 
Achievable 
immediately? 


Step 10 
Accept risk 


Step 12 

Implement interim 
countermeasures 


Step 13: Implement permanent countermeasures 


Figure 3. ISC Risk Management Process (After: U.S. Department of Homeland 

Security, 2010c) 
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Step 3 in Figure 3, the ISC Risk Management Process, is the first decision point, 
the FSC detennination whether the baseline LOP adequately addresses the risks or if the 
LOP should be adjusted. If the FSC determines the baseline level of protection is 
sufficient, the existing protection levels are deemed adequate and no further security 
protections are required (Step 5). However, if the FSC detennines the existing LOP is 
insufficient based on the risks, the committee must determine at Step 6 if the necessary 
LOP is achievable: “specifically, if the countermeasure can be physically implemented, 
and whether the investment is cost effective” 51 (U.S. Department of Homeland Security, 
2010c, p. 27). If the FSC detennines the necessary level of LOP 52 is not achievable, it 
must establish the highest achievable level of protection (Step 7). Once the highest LOP 
is detennined, the FSC must decide if it needs to find alternate locations for the facility 
and its operations (Steps 8 and 9) or is willing to accept the risk (Step 10). 

If, at Step 6, the FSC detennines the necessary level of protection, or, at Step 10, 
accepts the existing risk, the committee is required to detennine if the required 
countenneasures are immediately achievable or if interim countermeasures are required. 
Finally, at Step 13, the building or facility is required to implement the permanent 
countenneasures needed to satisfy the level of protection concomitant with the facility 
security level. While the term “pennanent countermeasures” is not defined within the 
standard, an appendix of security measures is included that serves to address the various 
threats identified during the security assessment. Arranged in tabular format, the security 
criteria are a mix of vaguely defined prescriptive and perfonnance-based 
countermeasures to the identified threats. Table 14 provides an example of how the 
security criteria are qualified that uses four security criteria generally applicable to fire 
protection and arson mitigation. 


51 Cost effectiveness is measured by comparing the cost of the countermeasure improvement to the 
value of the asset. 

52 Necessary LOP is defined as "the degree of security determined to be needed to mitigate the 
assessed risks at the facility” (U.S. Department of Homeland Security, 2010c, p. 7). 
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Table 14. Sample ISC Security Measure Details (After: U.S. Department of Homeland 

Security, 2010c) 


Security Criterion 

Detail 


Comply with applicable regulations regarding storage and safety 
requirements. 

Hazardous Materials 
Storage 

Depending upon the nature of the material, measures may be needed 
to prevent access to, release of, or unauthorized removal of the 
hazardous material from the site. 


Valves and control mechanisms also must be protected from 
unauthorized access. 

Protection of Water 
Supply 

Reference the current DBT established by the ISC, unless chemical, 
biological or radiation threat type is superseded by an agency-specific 
threat assessment. 

Emergency Exit 
Doors 

Electronic locks on perimeter doors must fail-secure, and electronic 
locks on interior doors must fail-safe, if such measures do not conflict 
with applicable fire and safety codes. 

Security of 
Ventilation 
Equipment and 
Controls 

To assure heating, ventilation and air conditioning system operation 
cannot be disrupted by someone physically accessing the controls; 
equipment should be located in a secure area with access limited to 
security and engineering staff. 


Since many of the security criteria are vaguely defined, and simply are 
instructions selected from an established menu, no means is available to evaluate their 
effectiveness against an anticipated threat. For example, in the Table 13 security criterion 
for hazardous materials storage, the guidance to “comply with the applicable regulations 
regarding storage and safety requirements” provides only a directive and no measure of a 
successful outcome. On the other hand, the directive that “valves and control mechanisms 
also must be protected from unauthorized access” defines the desired security end state. 
The FSC or security organization can establish means to achieve this clear performance 
objective. 

A second shortcoming of the Physical Security Criteria for Federal Facilities 
approach is its emphasis on threats that primarily are manmade. According to the report, 
“other threats to buildings, such as earthquakes, fire, or storms are beyond the scope of 
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this document and are addressed in applicable construction standards [emphasis added], 
although many of the countermeasures identified will contribute to mitigating natural 
hazards” (U.S. Department of Homeland Security, 2010c). This approach presumes the 
applicable construction standards—the model building codes—are adequate to protect 
against these and other natural hazards. The model building codes prescribe only 
minimum requirements, and do not have measurable outcomes of success. To say a 
federal building or facility “meets the code” is no assurance it will survive a natural threat 
since the scale and scope of the threat is not quantified in these construction standards. In 
other words, no performance expectation exists in the model construction standards, 
especially from threats, such as fire or arson. 

J. THE DBT (2010) 

Simultaneous to the release of the Physical Security Criteria for Federal 
Facilities standard, the ISC published a companion document, the DBT, which includes 
31 scenarios potential adversaries might employ to attack federal facilities. The DBT was 
inspired by a similar, but classified, document used by the Department of Energy (DOE) 
to manage potential risks (U.S. Government Accountability Office, 2004). The scenarios 
expand on the undesirable events enumerated in the Physical Security Criteria for 
Federal Facilities and included intelligence community assessments of the likelihood one 
or more of the scenarios will be implemented by an adversary. As the ISC developed 
threat scenarios, it was guided by the importance of creating specific examples for which 
permanent countermeasures could be developed. However, the companion documents fall 
short of this objective in several ways. The scenarios are inconsistently defined, and some 
significant (albeit not criminal) threats are dismissed as outside the scope of the work. 
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According to the report, the intent of the DBT was threefold. 

• To inforrn the deliberations of the ISC working groups as they establish 
standards 

• To support the calculation of risk upon threat, vulnerability and 
consequences, to a facility, when applying the Physical Security Criteria 
for Federal Facilities 

• To detennine the specific adversary characteristics that perfonnance 
standards and countermeasures are designed to overcome (U.S. 
Department of Homeland Security, 2010a) 

It is the last bullet that this thesis addresses with the hypothesis that the described 
arson-specific adversary and threat characteristics are too vague to enable the 
development of effective performance standards and countenneasures to control the arson 
threat and consequences. 

In developing the DBT, the ISC was challenged by the changing nature of 
criminal and terrorist threats, and recognized that a more flexible approach was needed to 
develop design standards and countenneasures. According to the DBT: 

First, the threat was typically based on publicized historical events, 
leading the government to design tomorrow’s facilities to meet yesterday’s 
threats. Today’s dynamic threat environment suggests a need to react to 
rapid change. The elapsed time between the identification of a need for a 
new Federal facility and the time it is occupied can be as long as 7 to 10 
years. In that time, the threat has likely changed substantially. Previous 
standards also incorporated aspects of the threat as part of the document 
itself, which made it difficult to keep the threat current without updating 
the entire standard. The threat changes faster than working groups can 
develop new standards. (U.S. Department of Homeland Security, 2010a, p. 

1 ) 

Furthennore, the committee recognized that a “one size-fits all” approach to 
physical security design was not appropriate for all federal facilities depending upon 
variables, such as the community in which the facility was located, neighborhood 
conditions, mission and operational functions, topography, and threats. The complexity of 
these variables—especially threats—led to the conclusion that prior, more generic 
methods of physical security assessments were not working. According to the report: 
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the validity of the threat is routinely called into question, not only in the 
characteristics of the threat itself (e.g., device size, weapon caliber, 
sophistication of the adversary), but in its applicability to a specific 
facility. More infonnation was needed to support the evaluation of the 
threat as it pertains to the estimation of risk for each facility. By providing 
guidance in that area, the consistency of threat ratings from facility to 
facility is improved. (U.S. Department of Homeland Security, 2010a, p. 1) 

In numerous references throughout the DBT document, the ISC emphasized the 
importance of “specific,” “consistent,” and “detailed” threat scenarios that should be used 
for countermeasure selection and design. At one point, the committee reported: 

with multiple working groups developing and updating a variety of related 
standards, the need for consistent infonnation regarding the threat to serve 
as the basis for all new standards is paramount. Each working group 
should be considering the same threat as they write standards to counter it. 

For example, in establishing standards for ballistic resistance of protective 
vests, a working group developing standards for contract guards should be 
considering the same weapons as a working group considering ballistic 
protection around a screening area. (U.S. Department of Homeland 
Security, 2010a, p. 2) 

However, most of the 31 threat scenarios included in the DBT are vague and 
immeasurable. Without specific and measurable criteria in the design scenarios, it is 
impossible for a FSC or designer to evaluate if the security objective can be achieved. 
Even the arson threat scenarios were inconsistently characterized in the Physical Security 
Criteria for Federal Facilities standard and two locations within the DBT. Table 15 
compares the different arson threat scenarios employed in the documents. 
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Table 15. ISC Arson Threat Scenarios (After: U.S. Department of Homeland Security, 

2010a) 


Source 

Page 

Threat Description 

Physical Security 
Criteria for 
Federal Facilities 

72 

An attack against a government facility by knowingly and 
willingly setting a fire with intent to cause damage or destruction 
to the facility and/or physical injury or loss of life to the 
occupants. 

DBT 

12 

Accessing a facility and deliberately setting fire to the facility or 
to assets within the facility. 

DBT 

7.2.1 

An adversary places an improved IID containing an accelerant 
and using a delay mechanism adjacent to a facility, but outside 
the view of security countermeasures. 


From a design perspective, each of these scenarios describes a different and 
unique set of conditions with unspecified outcomes. Therefore, the contention that these 
events are “specific,” “consistent,” and “detailed” threat scenarios is not substantiated. 
Given the dynamic nature of fire behavior, these three scenarios might have dramatically 
different results. For example, the threat description scenarios could range from a 
disgruntled employee setting fire to his workstation to an adversary tossing a flaming 
Molotov cocktail from a road onto a nearby airport taxiway where little or no damage 
might occur. The scenario frameworks should be consistent throughout the DBT since the 
countenneasures designed to address specific threat scenarios could differ significantly. 
None of the arson scenarios provides the specific threat characteristics that would enable 
a FSC or facility designer to select perfonnance standards and countenneasures designed 
to overcome the threat or consequences. 

According to the DBT report, quantifiable measures should be used for the 
development of countermeasures to defeat or mitigate specific events. “For example, 
when it is necessary to protect a facility against a vehicle-borne improvised explosive 
device (VBIED), the device size specified for VBIED events should be used for 
engineering calculations ” [emphasis added] (U.S. Department of Homeland Security, 
2010a, p. 6). Given the device size, ordnance experts and forensic analysts are capable of 
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determining the area of influence of a shock wave, detonation or deflagration velocity 
and pressure, destruction estimates, and casualty predictions within the blast zone 
(Murray, 1998; U.S. Department of the Air Force, 2006). Thus, when the engineering or 
scientific data exist to develop countermeasures, they should be employed, including for 
arson threats where critical elements within the scenarios may be quantified and 
appropriate countenneasures developed. 

Furthennore, the DBT assumes that criminal and terrorist-initiated “undesirable 
events” are somehow different from other environmental threats. This presupposition is 
made in the standard without substantiation and without acknowledging that the 
destructive effects of other threats can be equally damaging to the built environment. 
According to the DBT, “the events addressed in this document are man-made. Natural 
hazards such as earthquakes, floods, fire, or wind storms are beyond the scope of this 
document and are addressed in applicable construction and life safety standards” (U.S. 
Department of Homeland Security, 2010a, p. 2). This conclusion assumes that the 
applicable construction and life safety standards are adequate, but the report provides no 
justification for that finding. In particular—other than events caused by lightning—one 
could argue that all fires are manmade, either as a result of an intentional act or neglect in 
employing fire safety practices. To describe fire as a “natural hazard” and ignore its 
potential effects is short sighted, and to assume that fire prevention and mitigation are 
addressed satisfactorily in the applicable construction and life safety standards is a 
conclusion not quantified by the ISC. 

Although fire research and engineering are relatively young fields when compared 
among other scientific disciplines, recognized and validated methods do exist to quantify 
fire behavior in the built environment, which is discussed in greater detail in Section IV 
of this study. The ability to quantify fire behavior with some degree of assurance is at the 
core of performance-based design methods. When the fire threat—regardless if it is the 
result of a terrorist attack, criminal behavior, or a natural event—can be quantified, 
adequate permanent countenneasures can be evaluated. 
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K. SUMMARY 


The physical security of federal facilities assumed a new urgency when the Alfred 
P. Murrah Building was destroyed by a domestic terrorist attack in 1995. Since then, 
several federal agencies have developed a variety of security and construction standards 
intended to enhance safety for occupants, operations, and the non-military facilities 
themselves. Initially, these standards were intended to counter terrorist attacks using 
explosive devices, but have evolved into covering a broad range of criminal and terrorist 
threats. Over time, responsibility for the development and maintenance of these standards 
was assigned to an ISC within the DHS. 

As they developed, most of the physical security standards cited in this section 
were built upon a prescriptive foundation; guiding agencies to achieve a desired level of 
protection by giving precise design and construction advice. Since 2008, the standards 
have begun a slow process toward the development and implementation of performance- 
based countenneasures. An important next step is to quantify critical elements within the 
threats—especially arson—in terms that the engineering and design community can 
translate into quantifiable countermeasures. 
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IV. DEVELOPMENTS IN CONSTRUCTION METHODS AND 
CODES IN THE UNITED STATES 


For thousands of years, man has provided shelter for his family and belongings by 
erecting some sort of structure to protect them from the elements. Whether it was a rude 
hut or sophisticated multi-story building, these creations became part of the human 
landscape known as the built environment. This built environment is susceptible to any 
number of natural or manmade threats including earthquake, weather, fire, rodent and 
insect vectors, explosion, tsunami, hazardous material release, criminal enterprise, or 
terrorist attack. This section explains recent developments in regulations intended to 
strengthen the built environment in the United States, and explores the differences 
between traditional prescriptive and contemporaneous performance-based designs and 
codes. 

Initially, building construction relied on craftsmen who translated their vision or 
architectural designs into practical, usable, and often breathtakingly beautiful structures. 
These creations were limited only by the resources at hand: money and labor to build, 
natural materials, such as wood and stone to create the buildings, and the physical limits 
of these natural materials to support themselves and the structural loads 53 imposed upon 
them. As communities grew, however, social demands increased for safety and comfort 
in the built environment. Sanitation controls were needed to prevent the spread of 
disease. Structural requirements were implemented to prevent buildings from collapsing 
during routine use. Fire protection regulations were instituted to prevent conflagrations. 
Ventilation standards were instituted to improve personal comfort and health. These 
requirements eventually became fixed in locally enforced regulations and standards 
called construction codes, 54 more commonly known as building codes. 


53 “Loads” describes additional weights or stresses, both static and dynamic, which are applied to a 
building during its lifetime. The building itself constitutes a “dead load” that comprises the structural 
elements, permanent finishes, and attached features, such as air handling equipment and water towers. 

54 Construction codes typically comprise structural framing, plumbing, electrical, mechanical, fuel gas, 
and fire protection systems that go into the completion of a building. 
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Building and fire codes 55 frame critical infrastructure protection and resilience 
requirements. They establish a community’s minimum acceptable level of safety and 
utility within the built environment. Hospitals, government buildings, schools, factories, 
stores, fire and police stations, warehouses, single-family dwellings ... all are 
constructed in accordance with standards of design based on locally adopted and enforced 
building codes. 56 These documents are intended to prescribe requirements for safety from 
earthquake, weather, fire, or commonly recognized technological hazards, as well as 
provide for comfort and sanitation in accordance with recognized health standards. 

Granted, an important distinction exists between building design and code 
compliance. According to Thomas, “codes are minimums set by the community. Designs 
are comprehensive plans to make the owner and hopefully the users happy” (D. J. 
Thomas, n.d., p. 3). If architectural and design latitude did not exist, many buildings 
would be nothing more than utilitarian shelters, and lack the beauty and inspiration of the 
some of the nation’s greatest design achievements. Building designers and tenants are 
given the freedom to create both practical and striking structures that meet their 
functional requirements and aesthetic tastes. Generally, the architect or designer may 
create a building from any materials that can withstand normal operating loads and the 
effects of threats, such as high winds, snow, earthquake, or fire. While architects and 
tenants have the autonomy to design structures that meet their operational needs and 
artistic expressions, many communities imposed regulatory limitations through the 
adoption and enforcement of building codes in the interest of public and occupant safety. 
These regulations establish minimum safety levels, and in some circumstances, 
prescriptive requirements constrain design freedom by setting arbitrary limits on such 
things as building height, gross floor area, exit travel distances, and the use of specific 
materials to enhance fire resistance and structural integrity. Borrowed and adapted from 


55 Fire codes often are considered to be ‘'‘maintenance” codes that prescribe regulations to protect new 
and existing buildings—and their tenants—from fire during their routine occupancy. 

56 The regulation of building construction generally falls under state and local government police 
powers. However, it is acknowledged that not all jurisdictions elect to adopt and enforce building codes. 
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the SFPE (National Fire Protection Association & Society of Fire Protection Engineers, 
2000), for the purpose of this study, prescriptive design is: 

an approach where safety is achieved by specifying certain construction 
characteristics or materials, by limiting dimensions, or by specifying 
protection systems without referring to how these requirements achieve a 
desired safety goal. (p. 9) 

The distinction between design and codes becomes further complicated when 
properties owned by the U.S. government are involved. The Commission on Engineering 
and Technical Systems (Commission on Engineering and Technical Systems, 1989) 
explained that “Federal agencies are exempt from these state and local building codes 
(and from zoning laws as well), and are entirely responsible for all aspects of safety and 
health in their buildings” (p. 2). This freedom enables the federal government to set its 
own standards for design and safety. However, the Public Buildings Act of 1988 57 
specified that any building constructed or altered by the GSA or any other federal agency 
should be in compliance—to the extent feasible as detennined by the GSA 
administrator—with the latest published edition of one of the nationally recognized 
model building codes (Legal Infonnation Institute, 2011a). The GSA administrator may 
elect to decide that the aesthetic and iconic value of a particular design outweighs the 
feasibility of complying with building safety codes. This decision may be especially 
opportune when trying to apply current construction codes to historic public buildings, 
many of which may have been erected before specific regulations were conceived, 
developed, or adopted. Ironically, this latter circumstance bodes well for the opportunity 
to apply perfonnance-based designs where modern prescriptive regulations may be 
impossible to meet. 

A. EVOLUTION OF PRESCRIPTIVE DESIGNS AND CODES 

In the United States, regulations that evolved into building codes began as fire 
prevention and control laws during the colonial era. They were intended to mitigate the 


57 See 40U.S.C. §3312. 


85 



consequences of sparks from chimneys and flames from cooking fires consuming the 
many wooden structures predominant in that time. Later, in 19th century cities, buildings 
were constructed so close together they created fire hazards and conflagration potential. 
The Great Chicago Fire of 1871 that destroyed an estimated 17,500 buildings and killed 
as many as 300 persons highlighted the need for stronger building and fire codes 
(“Building Codes,” 1994). Many cities adopted their own building and fire safety codes 
based on their unique conditions of topography, weather, building materials, and 
construction practices. In 1905, the National Board of Fire Underwriters issued the first 
model 58 code developed in the United States, the Recommended Building Code (later 
renamed the National Building Code) (“Building Code,” 1994). Over time, other 
organizations adopted model construction codes, including the International Conference 
of Building Officials (1927), the Southern Building Code Congress International (1945), 
and the Building Officials and Code Administrators (1950). These groups competed for 
representation in various geographic areas of the United States, but in 1994, the 
organizations merged into the ICC. Another organization, the National Fire Protection 
Association, produced a competing set of construction codes and standards. 59 

Historically, building code development is a consensus process, with a nominal 
scientific or engineering foundation. Persons representing various professional disciplines 
or commercial interests may serve on one or more technical advisory committees that 
develop codes and standards to address various elements that affect building construction 
and safety. Generally, these committees follow specific procedures to assure equal 
representation of all interested participants—including the general public that may not 
have a dedicated place on the committee—and majority votes are conducted in 
accordance with legal and ethical standards to adopt or alter requirements. This 
democratic approach, Brannigan (2010) claimed, results in building codes that “are legal 
not essentially technical documents” (personal communication, September 16, 2010). The 

58 A “model” code is one created by one or more interest groups, usually having special expertise in 
the topic that may be legally adopted by reference by a community that does not have its own code or 
wishes to adopt regulations similar to other jurisdictions. 

59 “The fundamental difference between a code and a standard is that a code dictates what must be 
done while a standard spells out how to do it” (Building Technology, 1981). 
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basis for Brannigan’s assertion is that a preponderance of the proposed and adopted code 
requirements are based on the committee’s majority opinion of empirical evidence, and 
not based on comprehensive scientific inquiry or experimentation. This opinion is shared 
in a report commissioned by the U.S. Department of Housing and Urban Development, 
“the process is as much political as technical. Perhaps reflective of our American system 
of government, the entire process is known as ‘voluntary consensus’” (Building 
Technology, 1981, p. 12). The Building Technology report continues by stating the 
following.. 

The National Building Code through the 1931 edition has explanatory 
notes, pictures and diagrams throughout. Today, there is only legalese, too 
much detail, too little policy, no statement of intent, and far too many 
exceptions to poorly stated generally rules. This lack of clarity is not good 
for existing buildings because the exercise of flexibility and good 
judgment is made difficult when the intent is not clear. (Building 
Technology, 1981, p. 33). 

The national code-promulgating organizations 60 rely on committees having 
various levels of expertise that identify problems, offer solutions, and develop 
recommendations incorporated into the codes. While scientific and engineering studies 
about specific building components and their behavior under a variety of conditions may 
influence the committee recommendations, universal application of these tools to all parts 
of the building codes does not exist. As far back as 1921, then Secretary of Commerce 
Herbert Hoover, created a Building Code Committee at the National Bureau of 
Standards 61 in response to four identified defects in contemporary building laws: 1) they 
raised the cost of building and made the building industry inactive, 2) they failed to 
recognize modem methods, 3) they were based on compromises rather than scientific 
data, and, 4) they lacked unifonnity in principles (Building Technology, 1981). 


60 Today, the International Code Council and National Fire Protection Association remain the 
predominant code and standard promulgating organizations. 

61 The former National Bureau of Standards was a federal research laboratory in the Department of 
Commerce. In 1988, it became the National Institute of Standards and Technology (NIST). 
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Most current codes and designs are “prescriptive,” in that they prescribe specific 
minimum rules and features to which building designs must adhere. These regulations 
can run to hundreds of pages of very explicit criteria. Every building is assigned a “use” 
and “occupancy” class that establishes the framework for code compliance. For example, 
according to the International Building Code (International Code Council, 2009), a 
“place of public assembly” is defined as a building where “50 or more persons gather for 
the purpose of worship, entertainment, drinking and dining, education, awaiting 
transportation, or deliberation.” 62 Given this definition, do all “places of public 
assembly” have the same inherent hazards? Does the McDonald’s restaurant on the street 
corner have the same safety risks as New York’s Radio City Music Hall? Both meet the 
definition of “places of public assembly,” but even people who know nothing about codes 
would reason they do not possess equal threats to life or property because of the number 
of people who might be inside at any one time or the variety of potential safety hazards 
that might exist. Why are prescriptive designs and codes a problem? Prescriptive designs 
and codes employ generic solutions applied to different use and occupancy situations and 
may not adequately address the overall vulnerabilities, risks, and hazards needed to create 
a resilient infrastructure. Prescriptive codes also are criticized for increasing construction 
costs while discouraging evolutionary architectural design and building product 
innovation. 

Significant prescriptive code changes often occur as the result of a tragedy that 
captures public attention. Following the 2001 World Trade Center attacks where fire 
fighter access and occupant evacuation were an issue, the model building code was 
amended to add new construction requirements for special elevators, fire protection 
systems, and high-perfonnance fire resistant construction in so-called ultra-high-rise 
buildings that exceed 420 feet (128 m) in height (National Institute of Standards and 
Technology, 2008). After 100 nightclub patrons died in 2003 in a fast-moving fire in 
Rhode Island, the model codes adopted requirements for automatic fire sprinklers in 

62 This example is a classic example of empiricism in prescriptive codes. The number of people that 
creates a defined place of public assembly, 50, has no basis in science. It is an irrational number selected by 
a consensus committee to establish a benchmark for code compliance. 
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similar occupancies (Jonic, 2013). Nine fire fighters in Charleston, South Carolina died 
on June 18, 2007 in a single-story furniture store. The most recent editions of the model 
building codes have been amended to include requirements for automatic sprinklers in 
retail stores where highly combustible upholstered furniture is sold (International Code 
Council, 2012). While each of these events was tragic, the code changes they spawned 
were based more on emotional response to the incidents than a comprehensive analysis of 
the fire and life safety threat that all high-rise buildings, nightclubs, or furniture stores 
pose. 

It is important to acknowledge that the national model building codes establish 
only minimum life safety and fire protection standards. No prohibition occurs that 
prevents an architect, designer, owner or tenant from providing additional features that 
may enhance safety and security beyond the minimums specified in the code. As a simple 
example, the model building codes require office buildings more than three stories high 
to have two distinct egress paths via stairways. With some unique exceptions, these stairs 
are required to be physically separate. Thus, if one stairway were compromised, 
occupants should expect to have an alternate means of escape via the other stairway. 
Nothing in the building codes would prevent the architect or tenant from providing 
additional stairways for safety or convenience; those elective features could be added at 
the owner’s discretion. 

In addition to their generic scope, prescriptive codes and designs are criticized for 
discouraging innovation, being inflexible to evolving changes in methods and materials, 
and unnecessarily increasing design and construction costs. A common criticism of 
building codes is that they stifle innovation in both materials and design. In the 1970s, 
several independent and government-sponsored reports were critical of both building 
codes and how they were enforced. Gauchat and Shodek (1977) found that “by 
prescribing specific methods and materials of construction specification codes may also 
protect the interest of certain participant groups in the building industry rather than act in 
the interest of all. Union and labor groups clearly have a vested interest in some items in 
a typical specification code” (p. 22). Richards (1977) was critical of the role-building 
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product developers played in construction regulations. He claimed “innovation in 
building codes and standards too often is implemented only after producer monopolies 
are assured no damage will be done to their vested interest, and secondly, that they will 
benefit from any change” (p. 280). Oster and Quigley (1977), however, found that greater 
detenninants affecting the diffusion of constructional innovation were the educational 
level of the chief building official, the extent of trade unionism in the study area, and the 
relative size of construction companies. 

Also, prescriptive designs and codes are blamed for increasing construction costs 
when their requirements might exceed the nature of the threat. In one example cited by a 
leading industrial risk assurance firm, the “codes can be too restrictive, causing facilities 
unnecessary expense. For example, the codes could call for the construction of a 3-ft 
(0.9 m) dike around a flammable liquids tank when a one-ft (0.3 m) containment would 
suffice [to contain any spills or leaks from the tank]” (“Building Codes,” 1994, p. 8). 
Prescriptive codes are full of similar examples where accreted requirements added over 
time increase construction and maintenance costs without concomitant measurable safety 
improvements. Likewise, prescriptive designs and codes have long been recognized as 
not flexible enough to address all situations or threats (Frantzich, 1998). Not all hazards 
and their controls fit well into the traditional prescriptive model. When the semi¬ 
conductor fabrication industry evolved in the early 1980s, its chemical hazards and 
operational processes were so different from anything previously encountered that no one 
could figure out how to apply traditional building and fire code requirements. Entire new 
provisions had to be developed to address this new technology. 

Perhaps most significant, prescriptive codes have no means to evaluate the 
success or failure of compliance with their requirements. Torero (2006) found that 
despite the technical origin and empirical basis of past prescriptive codes, they are 
incapable of assessing the perfonnance of a building under fire conditions; instead, they 
simply assume adequate safety levels are met. New York’s World Trade Center complex 
was a classic example of prescriptive design that proved vulnerable to an unanticipated 
and evolving threat. Both towers were designed to withstand the routine rigors of 
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weather, vibration, earthquake, and other loads. They were even designed to survive the 
impact of an airplane, which they did on September 11, 2001. 63 According to Eagar and 
Musso (2001), “the early news reports noted how well the towers withstood the initial 
impact of the aircraft; however, when one recognizes that the buildings had more than 
1,000 times the mass of the aircraft and had been designed to resist steady wind loads of 
30 times the weight of the aircraft, this ability to withstand the initial impact is hardly 
surprising” (p. 8). More significant was the deflagration of nearly 24,000 gallons 
(90,850 L) of jet fuel with the ensuing fire among the building’s nonnal contents that was 
the principal cause of the collapse (Eagar & Musso, 2001). The prescriptive design and 
engineering standards in place when the World Trade Center was built had not 
anticipated a fire of this magnitude. 64 Furthermore, an early post-incident analysis of the 
World Trade Center event by the Federal Emergency Management Agency reinforced 
Eagar and Musso’s findings and added that many of the “structural and fire protection 
features of the design and construction were found to be superior to the minimum code 
requirements” (Federal Emergency Management Agency, 2002b, p. 2). Thus, despite 
evident compliance with prescriptive building code requirements, no way existed to 
predict these buildings’ perfonnance when attacked by fire in combination with the 
aircraft impact. 

In their article, Risk Perception in Performance-Based Building Design and 
Applications to Terrorism-Resistant Design, Thompson and Bank (2007) argued that: 

As terrorism represents a constantly changing design challenge, it seems 
unlikely that prescriptive code requirements will be fully effective in 
countering this hazard. Codes are not intended to be static documents, but 
must evolve as new information becomes available or new situations arise. 

PBD is well suited for design issues that deal with evolving, “cutting- 


63 Additionally, the north tower survived a subterranean truck bombing in 1993 that attempted to 
topple it onto the south tower. 

64 In an eerily prescient comment, a U.S. Department of Housing and Urban Development building 
regulation report said, “On July 28, 1945, an Army bomber lost in the fog literally flew into the side of the 
Empire State Building. Though 14 died from the crash and ensuing fire, the building was essentially 
undamaged. Not that the World Trade Center would collapse under a similar stress, but the factor of safety 
gained through the inherent overdesign of earlier construction methods and materials is lacking" (Building 
Technology, 1981, p. 40). 
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edge” concepts. PBD is also well-suited to use in a target-specific hazard 
environment, as appropriate performance objectives can be chosen 
according to the hazard level of individual buildings. Thus, PBD seems a 
natural approach for development of an adaptable terrorism-resistant 
design methodology, (pp. 66-67) 


B. PERFORMANCE-BASED DESIGNS AND CODES 

One of the key opportunities for protecting lives and increasing resilience in the 
built environment exists in the adoption and application of building designs and codes 
that can be customized to address specific threats. Prescriptive codes provide a generic 
framework, but cannot address all natural or manmade threats. Code compliance alone is 
no assurance that a building will successfully resist fire damage caused by an accident or 
a malicious attack. Performance-based designs and codes are outcome-driven, the desired 
end state is developed and alternative design solutions are offered to meet it. 

No universal definition exists for perfonnance-based design. As have many 
others, Gross (1996) cited the ancient Babylonian Code of King Hammurabi who decreed 
that if a builder constructed a house and the house fell and killed the occupant, the builder 
must be put to death, as the first perfonnance-based requirement. However, in more 
contemporaneous terms, Gross added that the perfonnance concept was often interpreted 
differently among different users. To some, he wrote: 

it is a concept of qualitative aspirations for buildings without a systematic 
methodology for analysis and verification. For others, [it] is a concept 
which requires quantitative analysis and rigorous evaluation that at times 
discourages those who wish to use the concept when these tools are not 
available. (Gross, 1996, p. 5) 

For the purpose of this study, however, a single working definition is required. The 
following description is borrowed from the SFPE (National Fire Protection Association 
& Society of Fire Protection Engineers, 2000): 


92 



performance-based design is an engineering approach to building design 
based on established safety goals and objectives; deterministic and 
probabilistic analysis of threat scenarios and quantitative assessment of 
design alternatives against the goals and objectives using engineering 
tools, methodologies and perfonnance criteria, (p. 9) 

Detenninistic analysis is a method of evaluation that presumes the net result will 
always produce the same outcome or prediction for a given set of identified conditions. 
Probabilistic analysis, on the other hand, considers the likelihood of different scenarios 
and the conditions that describe them to draw conclusions on potential losses and 
consequences (National Fire Protection Association & Society of Fire Protection 
Engineers, 2000). Perfonnance-based solutions are intended to establish measurable 
tenant use and occupancy perfonnance objectives—not arbitrary rules—and provide 
scientific or engineered design solutions to meet them. Alvarez and Meacham (2010) 
found that one of the main advantages of performance-based design—particularly for fire 
safety—is that it enables the designer to propose and evaluate options equivalent to other 
code requirements, but “without imposing undesired constraints on aspects of building 
design, such as design flexibility, innovation, or maximization of cost/benefit ratio” (p. 
2 ). 

Perfonnance-based designs are not limited to fire safety solutions and they can be 
employed to address a broad range of homeland security issues; the key is for those who 
have an interest in the building’s design and use (the “stakeholders”) to quantify the 
range and scale of potential threats to the building or facility. One perfonnance objective, 
for example, may be the occupant’s desire for reliable continuity of operations; therefore, 
the design solutions are focused on maintaining operational reliability. This objective 
may be particularly important to government agencies. Another perfonnance objective 
may be to create a large open-area building without fire resistive construction or built-in 
fire protection systems to permit special research and development projects. Prescriptive 
codes may not permit a project of this scale. The design flexibility to address specific 
infrastructure protection needs is not intrinsic to prescriptive designs or codes. For 
example, due to their size and character, most of the unique mega-hotel/casino projects 
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built in Clark County, Nevada, in the last two decades, employed some combination of 
perfonnance-based design elements because they could not comply with the limitations 
of prescriptive methods. In perfonnance-based design, each structure essentially is 
constructed to its own unique building code. 

To provide a legal framework for code enforcement authorities to accept and 
evaluate proposed perfonnance-based designs, the ICC in 2001 published the ICC 
Performance Code for Buildings and Facilities. The code is intended to provide for “an 
environment free of unreasonable risk of death and injury from fires” and “an acceptable 
level of life safety and property protection from the hazards of fire, explosion or 
dangerous conditions in all facilities, equipment and processes” (International Code 
Council, 2009). By 2011, 11 states and 54 local jurisdictions in the United States had 
adopted the ICC Performance Code for Buildings and Facilities (J. Gibson, personal 
communication, May 9, 2011). Despite this effort, in the United States, Hurley (2008) 
found that its use has not been widely accepted, “anecdotal evidence suggests that 
performance-based design is used on five to 10 percent of building design projects” (p. 
2 ). 

The ICC Performance Code for Buildings and Facilities (the Code) provides 
design guidance in two critical areas, descriptions of appropriate “performance groups” 
for buildings and facilities, and maximum levels of damage that can be tolerated based on 
the magnitude of specific events. The relationship between perfonnance groups and event 
magnitude is explained in subsequent text. First, Table 16 summarizes the four 
perfonnance group classifications that rate buildings and facilities based on their 
significance to the community in which they are located. 
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Table 16. ICC Performance Code for Buildings and Facilities Performance Group 
Classifications (After: International Code Council, 2001) 


Performance 

Group 


Use or Occupancy for Specific Buildings or Facilities 

I 

Agricultural facilities, temporary facilities and minor storage 
facilities. 

II 

All buildings and facilities except those listed in Perfonnance 

Groups I, III or IV. 


Buildings and facilities that represent a substantial hazard to human 
life in the event of a failure, including, but not limited to: 


1 . 

Buildings or facilities in which more than 300 people 
congregate in one area. 

III 

2. 

Elementary schools, secondary schools or day care facilities 
with a capacity more than 250. 


3. 

Health care facilities with a capacity of more than 50, but 
lacking surgical or emergency treatment capacity. 


4. 

Jails and detention facilities. 


5. 

Power generation, water treatment, or other public facilities not 
included in Performance Group IV. 


Buildings and facilities designated as essential facilities, including 
but not limited to: 


1 . 

Hospitals and other health care facilities with surgical or 
emergency treatment capacity. 


2. 

Fire, rescue, and police stations and emergency vehicle 
garages. 

IV 

3. 

Designated emergency preparedness, communication and 
operations centers, and other facilities required for emergency 
response. 


4. 

Buildings and facilities having critical national defense 
functions. 


5. 

Essential utilities for back-up power generation and water 
distribution for fire suppression. 


95 



Although federal government facilities are exempt from locally adopted building 
and fire codes, they most nearly represent occupancies described in performance groups 
III and IV. These performance group descriptors might be used to provide the ISC 
additional data for their design considerations. 

Since building and fire codes represent a community’s minimum standards for the 
risk it is willing to accept, the Code includes characteristics of the maximum level of 
damage to be tolerated, which is the second element in the relationship between 
perfonnance groups and event magnitude. Levels of impact are characterized as mild, 
moderate, high, and severe depending upon their effect on structural damage, 
nonstructural systems, occupants, hazardous materials, and the overall extent of damage 
(International Code Council, 2001). Third, the magnitude of events—including natural 
and technological (or manmade) hazards—is the severity of the consequences of potential 
threats and vulnerabilities as expressed “deterministically or probabilistically according 
to the best current practice of the relevant profession as published in recognized 
authoritative documents” (International Code Council, 2001, p. 15). Event magnitude is 
classified as small, medium, large, and very large. 

In combination, the performance groups, levels of impact, and event magnitude 
define the Code’s maximum level of damage that can be tolerated. Figure 4 captures 
these criteria. 


96 



Increasing Level of Performance => 


Performance Groups 


I II 


III 


IV 


-4—» 

<D 

> 

a 

8 

<D 

> 


Very Large 
(Very Rare) 

Severe 

Severe 

High 

Moderate 

w 

c 

.5? 

t/1 

d> 

Q 

w 

o 

<D 

3 

4 -» 


Large 

(Rare) 

Severe 

High 

Moderate 

Mild 

O 

<D 

=3 

’3 

a 

s 

c 

60 

c3 

s 


Medium 
(Less Frequent) 

High 

Moderate 

Mild 

Mild 

C fl 

a 

<D 

o 


Small 

Moderate 

Mild 

Mild 

Mild 


a 

HH 


(Frequent) 






Figure 4. ICC Perfonnance Code for Buildings and Facilities Maximum Tolerated 
Damage Levels (After: International Code Council, 2001) 


Using Figure 4, the maximum tolerated damage level to a building having critical 
national defense functions (Performance Group IV) must be mild for small, medium, or 
large events, and only moderate for very large or very rare events. 

In the federal environment, where its own construction standards are applicable, 
they permit performance-based design as an alternative to the prescriptive methods. The 
ISC Physical Security Criteria for Federal Facilities is a significant step toward 
performance-based fire safe design in federal facilities because it relies on the tenants 
who possess a stake in building operations and safety to describe their desired protection 
levels. However, this document addresses only threats it describes as “primarily 
manmade,” and claims other threats, such as earthquake, fire, or storms are beyond the 
scope of the document and are addressed in other applicable construction standards (U.S. 
Department of Homeland Security, 2010c). 


97 


























c. 


APPLICATION OF PERFORMANCE-BASED DESIGN 


The SFPE publishes a model for the application of the perfonnance-based design 
process, which is an iterative process that begins when a project is proposed and 
continues through completion. Figure 5 depicts the SFPE perfonnance-based design 
model. The ISC Physical Security Criteria for Federal Facilities standard does not 
address evaluation methods for the pennanent countenneasures it suggests; thus, this 
thesis is limited to the first six steps of the SFPE model that may provide guidance for the 
ISC to develop evaluative criteria for trial designs. 
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SFPE Performance-Based Design Process Model 
99 


Figure 5. 






The first step in the design process, defining the project scope, is important for the 
design team and stakeholders to establish fundamental agreement upon what the project 
will encompass. The composition of the stakeholder group can be project-specific, and 
can include the building’s owner, tenant representatives, architects, interior designers, 
maintenance personnel, and even neighboring property owners. In the Physical Security 
for Federal Facilities framework, the FSC represents a logical and important stakeholder. 
Agreement upon the project scope is expected to maximize overall project success. If, for 
example, the tenant is expecting a major overhaul of their tenant space to improve the 
office environment for enhanced workflow, but the design team is expecting only to 
upgrade fire protection features and building services, substantial potential for conflict 
can occur between the expectations and the outcome. A well-defined and documented 
project scoping exercise reduces the likelihood of conflict. 

In the SFPE model’s second step, a stakeholder group establishes project goals. 
These goals generally are not measurable, but describe the project team’s desired 
outcomes. SFPE (National Fire Protection Association & Society of Fire Protection 
Engineers, 2000) includes the following model goals for fire safety that are highly 
applicable to federal properties: 

• Provide life safety for the public, building occupants, and emergency 
responders. Minimize fire-related injuries, and prevent undue loss of life. 

• Protect property. Minimize damage to property and cultural resources 
from fire. Protect building, contents, and historical features from fire and 
exposure to and from adjacent buildings. 

• Provide continuity of operations. Protect the organization’s ongoing 
mission, production, or operating capability. Minimize undue loss of 
operations and business-related revenue due to fire-related damage. 

• Limit the environmental impact of the fire. Protect air and water quality by 
minimizing emissions and controlling runoff (p. 27). 

In the overall project context, the number and scope of stakeholder goals are not 
limited, and may include such things as minimizing construction costs, maximizing 
design flexibility, maintaining neighborhood character, employing unique architectural 
features or materials, or improving pedestrian flow. 
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Since the goals are non-specific, eventually metrics must be applied to detennine 
if the selected design criteria are appropriate. Refining the goals into stakeholder design 
objectives is the next step. Stakeholder objectives provide more detail than the goals, and 
may be described in terms of maximum acceptable or sustainable loss, or the tolerated 
levels of risk. In some instances, the stakeholder objectives may be clearly articulated. 
For example, in the goal category of protecting property, the objective might be to 
confine a fire to the room where it starts. Given this level of tolerated loss, the design 
team can begin to develop fire protection and construction strategies intended to prevent 
damage from exceeding the specified level. 

Next, quantifiable performance criteria are developed that eventually are used as 
benchmarks against which various designs can be compared. The performance criteria are 
related to, but more specific, than the stakeholder design objectives, and include 
threshold values, ranges of threshold values, or distributions of results from the sample 
fire scenarios that will be employed (National Fire Protection Association & Society of 
Fire Protection Engineers, 2000). If the design objective is to confine a fire to the room of 
origin, one measurable performance criteria might be that the temperature inside the 
room does not exceed a certain threshold (e.g., 1,112°F [6,000°C]), and the temperatures 
in adjacent spaces remain at levels that will enable humans to survive (e.g., 135°F 
[57°C]). These perfonnance criteria are used to provide design guidance for safe egress 
times, desired fire control, smoke management, or fire protection system perfonnance. 
While the number of performance criteria is limited only by the stakeholders and design 
team, it is important to note that as more criteria are added, the design solutions—or what 
the Physical Security for Federal Facilities standard might call permanent 
countermeasures [emphasis added]—become more complex. Furthennore, it is essential 
to acknowledge, “it is impossible to achieve a completely hazard- or risk-free 
environment. Additionally, as the level of hazard or risk decreases, the costs associated 
with those decreasing levels of risk typically increase” (National Fire Protection 
Association & Society of Fire Protection Engineers, 2000, p. 36). For stakeholders and 
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the design team, an important part of the performance-based design process is 
establishing realistic perfonnance criteria that can be achieved within both the project 
scope and budget. 

D. DESIGN FIRE SCENARIOS 

A critical component of performance-based design for fire safety is the 
development of rational lire scenarios that could occur in the building or facility under 
study. The design fire scenarios are developed and evaluated—often using fire-modeling 
techniques—to assess the effectiveness of proposed design solutions. According to 
Hurley and Quiter (2003), the design lire scenarios must be based on the reality of 
potential lire effects from the nature of the occupancy, the fuel load, potential changes in 
the property, the presence of fire detection and protection systems, and the purpose for 
which the design fire is being developed. The lack of a clearly defined and quantifiable 
design lire is the main deficiency of the DBT arson scenario used in the Physical Security 
for Federal Facilities standard since the following conditions are not quantified “an 
adversary places an improvised incendiary device (IID) containing an accelerant and 
utilizing a delay mechanism adjacent to a facility, but outside the view of security 
countermeasures” (U.S. Department of Homeland Security, 2010c). The IID size and 
accelerant characteristics are not described and its distance from the facility 65 is not 
specified. These factors are important in developing permanent countenneasures. 
Without explicit threat criteria, it is impossible to evaluate whether proposed pennanent 
countenneasures can be or are effective. (It is not clear from the DBT what significance 
the “delay mechanism” or “outside the view of security countermeasures” play in the fire 
consequence scenario unless it is anticipated that a delayed ignition or early detection by 
surveillance would enable an intervention before the IID has a chance to ignite. These 
elements are outside the scope this study). 


65 Likewise, the facility’s construction characteristics (e.g., combustible, non-combustible, or fire 
resistive) are important to determine the potential consequences of the IID. 
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The quantification of design fire scenarios is a two-step process. First, a design 
fire curve is developed that represents the four phases of a fire 66 that might occur in the 
studied project: ignition, growth, full development, and decay (Hurley & Quiter, 2003). 
In its simplest portrayal, a design fire curve characterizes the evolving temperature 
behavior of a fire in a compartment. The ambient room temperature is not significantly 
altered at the outset by the ignition of a fuel, but as the fire grows and reaches full energy 
output, the temperature rises until it reaches its maximum based on available fuel and 
ventilation. As the fuel and oxygen are consumed, the fire eventually enters a decaying 
state until it loses all energy or is extinguished. The second part of the fire scenario 
quantification exercise is predicting the potential fire effects from the results of the fire 
models. These effects may include smoke and fire spread beyond the room of origin, fire 
growth to structural collapse, occupant tenability, or the operation of fire protection 
systems. 

Since design fire scenarios are expected to represent fires that likely could occur 
in a building or facility, the fire protection engineering community over time has 
developed a variety of standardized scenarios against which design professionals can test 
their proposed life safety and fire protection design solutions. Table 17, which represents 
design fire scenarios created for the National Fire Protection Association’s Life Safety 
Code, is repeated to illustrate some sample design fire scenarios. 


66 Fire behavior is explored in greater detail in Chapter IV. 
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Table 17. Design Fire Scenarios from NFPA 101, Life Safety Code (After: National 

Fire Protection Association, 2012) 


Scenario 

Elements 

1 

Occupancy-specific fire representative of a typical fire in the occupancy. 

Explicitly accounts for occupant activities, number, and location, room size, 
furnishings and contents, fuel properties and ignition sources, ventilation 
conditions and identification of the first item ignited and its location. 

2 

Ultra-fast developing fire, in the primary means of egress, with interior doors 
open at the start of the fire. 

3 

Fire starting in a normally unoccupied room, potentially endangering a large 
number of occupants in a large room. 

4 

Fire originating in a concealed wall or ceiling space adjacent to a large occupied 
room. 

5 

A slowly developing fire, shielded from fire protection systems, in proximity to 
a high occupancy area. 

6 

The most severe fire resulting from the largest possible fuel load characteristic 
of the nomial operation of the building. 

7 

An outside exposure fire. 

8 

Fire originating in ordinary combustibles in a room or area with each passive or 
active fire protection system independently rendered ineffective. 


While these scenarios are included in a nationally recognized model safety code, 
they are not the only design fire scenarios that might exist. It is incumbent upon the 
stakeholders and design team to reach a consensus on the variety and scale of potential 
design lire scenarios that could occur in a specific project under consideration. The range 
of potential events from the routine to the farfetched may have to be considered, which is 
what Ripley (2009) called “the unthinkable.” Hurley and Quiter reported that some risk 
evaluations must be used when developing fire scenarios: “though a fire may be 
technically plausible, if it is extremely unlikely, that fire may not be necessary to include 
as a design fire” (2003, p. 3-151). Several design fire scenarios are employed in this 
thesis to illustrate whether the arson threat scenario in the DBT can be quantified for 
selecting pennanent countenneasures. 
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As design fire scenarios are developed, the design team must consider that the 
nature and use of the occupancy may change over time. The initial project assumptions 
may not remain the same over the life cycle of the building or facility that could affect 
the original design criteria. For example, if conditions (e.g., spatial configuration, fuel 
load, fuel array) change, the fire protection features may have to change to match the new 
arrangement because the original design strategies may no longer perform as expected. 
While this situation is more problematic in properties under private ownership 
susceptible to market pressures of sale or lease and change of use, it is a legitimate 
concern in public facilities as well. Developing the range of potential changes is known 
as establishing bounding conditions (Hurley & Quiter, 2003) and will be explored in 
further detail in the section on evaluating permanent countermeasures through risk 
analysis. 

The potential breadth of design fires must be considered as well. Note that in 
Table 17, all the design fire scenarios begin with a single ignition event. These scenarios 
do not consider fire’s influence as a consequence of another significant event as 
evidenced by the 2001 World Trade Center aircraft attacks. Writing in Extreme Event 
Mitigation in Buildings, Custer, Marrion, and Johann (in Meacham & Johann, 2006) 
noted that for fire safety planning and design, it is important to include fires resulting 
from extreme events, as well as severe events that might occur as a result of a fire. 
Stakeholders should be encouraged to think freely about potential threats regardless of 
their immediate plausibility. Multiple IID attacks, a gasoline tanker driven into a 
building, or a liquefied petroleum gas delivery vehicle detonated adjacent to a structure 
may be the sorts of extreme events that result in simultaneous significant fires in multiple 
locations. Fire safety design in the current prescriptive environment and recommended 
design fire scenarios are ill suited to protect against these catastrophic threats. Custer, 
Marrion, and Johann (2006) close their article by writing: 

Evaluating candidate [design] strategies requires development of realistic 
design fire scenarios that encompass worst-case conditions and rational 
decision-making techniques based on the risks and consequences of those 


105 



scenarios. This process is critical, because it can help ensure that buildings 
are designed with attention to the actual fire hazards they may encounter 
in mind. (p. 266) 


E. TRIAL DESIGNS 

Once the design team has agreed upon perfonnance criteria and a representative 
sample of design fire scenarios, the means that might be employed to mitigate the fire 
impacts are developed through trial building and fire protection system designs 67 (see 
Step 6 in the SFPE design model, Figure 5). The trial designs may include features from 
one or more components or sub-systems that comprise the building or facility’s physical 
or operational characteristics, as well as the physical features of fire resistant 
construction, the use of automatic fire detection and suppression systems, and the 
operational traits of fire behavior, smoke spread, and occupant behavior and egress 
(National Fire Protection Association & Society of Fire Protection Engineers, 2000). The 
trial designs give the design team the opportunity to identify and evaluate a variety of 
solutions against the performance criteria before committing to a final design. If the trial 
designs perform within the prescribed criteria and design fires, they are considered to be 
acceptable designs. This approach gives the design team maximum flexibility in materials 
and design while not being bound to the restrictions of a prescriptive set of regulations, 
such as those outlined in the DBT . 

F. EVALUATING TRIAL DESIGNS AND PERMANENT 

COUNTERMEASURES 

Unlike prescriptive designs and codes, perfonnance-based design requires critical 
evaluation to compare expected results to the initial design objectives and performance 
criteria to satisfy the stakeholders. While the concept of building “safety” is subjective 
and lacks dimension, according to Frantzich (1998), it can be evaluated by comparing the 


67 Within the context of the Physical Security for Federal Facilities standard, the list of permanent 
countermeasures is the primary menu of solutions from which federal Facility Safety Committees (FSC) 
and design teams select to satisfy the scenarios in the DBT . 
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proposed design with accepted solutions or with specified tolerable levels of risk. 
“Comparing the design solution with acceptable solutions can be performed on three 
levels: 

• Simple handbook solutions, i.e. using prescriptive regulations. 

• Calculation on sublevel, for example, evaluating escape time 
margin. 

• Evaluation on system level, i.e., perfonning a quantitative risk 
analysis (QRA).” (pp. 314-315) 

Perfonnance-based designs often employ design, construction, or material options 
unique, new, or untested in the traditional regulatory environment. This evaluation 
provides stakeholders, the design team, and code enforcement officials a level of 
confidence in the proposed design. One cannot simply argue the design “meets the code,” 
but must show that one or more of the proposed designs will perfonn in accordance with 
the criteria specified by the stakeholders. The design professional accomplishes the 
analysis through a variety of risk analysis techniques intended to enhance reliability 68 and 
reduce uncertainty. The Physical Security for Federal Facilities standard describes risk as 
“a function of the values of threat, consequence and vulnerability. The objective of risk 
management is to create a level of protection that mitigates vulnerabilities to threats and 
their potential consequences, thereby reducing risk to an acceptable level” (p. 20) and the 
Facility Security Committee is responsible for determining and accepting risk based on 
the results of the standard’s evaluation process (Figure 3). 

Frantzich (1998) identified three methods of risk analysis developed by the 
International Electrotechnical Commission in its International Standard 603 00-3-9: 69 
qualitative, semi-quantitative, and quantitative. The first, qualitative, is used to identify 


68 In this context, “reliability measures whether a design or system will function as designed or 
intended" 1 (National Fire Protection Association & Society of Fire Protection Engineers, 2000, p. 89). 

69 The standard, entitled “Dependability management-Part 3: Application Guide-Section 9: Risk 
Analysis of Technological Systems” was withdrawn by the International Electrotechnical Commission on 
March 4, 2011. 
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extreme hazardous events without ranking them to any particular degree of hazard. 
Frantzich recommended qualitative methods be used as a screening method in a 
preliminary risk analysis. 

Second, semi-quantitative risk analysis methods are used to determine a ra nk 
ordering of unwanted events. Hazards are assigned a point value, and then ranked 
according to some standardized scoring system, such as that used in NFPA 101 A, 
Manual on Alternative Approaches to Life Safety. In this method, that Frantzich called 
indexing, point scheme, or numerical grading, recognized hazards are assessed a 
numerical value, and the sum of the identified problems detennines the overall risk. 
Finally, in quantitative risk analysis, either a probabilistic or detenninistic approach is 
used to consider all the variables that might influence the outcome of a fire. According to 
the SFPE (National Fire Protection Association & Society of Fire Protection Engineers, 
2000), deterministic analysis is a method of evaluation that presumes for a given set of 
identified conditions; the net result will always produce the same outcome or prediction. 
Probabilistic analysis, on the other hand, considers the likelihood of different scenarios 
and the conditions that describe them to draw conclusions on potential losses and 
consequences. 

In classical risk analysis, total risk is the sum of the products of all events times 
their consequences. All the anticipated design fire scenarios and their consequences (e.g., 
injuries, deaths, extent of property damage, business, or service interruption) are 
considered against the potential frequency of their occurrence. Any elements that might 
influence fire outcomes—such as inoperable fire protection systems or compromised fire 
resistive construction features—are factored into the analysis. Historical data on the 
number of fires in similar properties are used to estimate the frequency of events. The 
number of variables that must be computed is dependent upon the project scale and the 
stakeholders’ demand for accurate analysis. As more potential scenarios are evaluated, 
the accuracy of the analysis increases. Given the small data set for arson fires in federal 
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properties compared to the substantial amount of federally owned or leased resources, the 
use of classical risk analysis to evaluate design fire perfonnance criteria may 
underestimate the potential vulnerabilities. 

Rather than anticipate every conceivable arson scenario and their potential 
consequences through classical risk analysis, risk binning analysis can be employed to 
develop an approximate, quantified risk assessment (National Fire Protection Association 
& Society of Fire Protection Engineers, 2000). In risk binning analysis, the need to 
inventory every scenario is lessened, and a greater emphasis is placed on realistic worst- 
case scenarios ranked according to their likely occurrence. Events are put into categories 
or bins to provide quantifiable results. Generally, in accordance with acceptable 
engineering principles, the consequences should cover 95% of all possible event 
outcomes 70 (National Fire Protection Association & Society of Fire Protection Engineers, 
2000). The stakeholders must describe the range of consequences and their value. Table 
18 provides an example of how consequences might be ranked by the stakeholders. 


Table 18. Possible Consequence-Ranking Criteria (After: National Fire Protection 
Association & Society of Fire Protection Engineers, 2000) 

Consequence Level Impact on Humans Impact on 

_ Property/Operations 


High (H) 

Sudden fatalities, acute 
injuries, immediately life- 
threatening situations, 
permanent disabilities. 

Building destroyed, 
operations and service 
delivery temiinated. 

Moderate (M) 

Serious injuries, permanent 
disabilities, hospitalization 
required. 

Building uninhabitable, major 
equipment destroyed, delayed 
operations functional at 
another location. 


70 The 95% value is derived from two national consensus engineering standards, the U.S. Guide to the 
Expression of Uncertainty in Measurement from the American National Standards Institute, and Test 
Uncertainty: Instruments and Apparatus, from the American Society of Mechanical Engineers. 
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Consequence Level 

Impact on Humans 

Impact on 



Property/Operations 

Low (L) 

Minor injuries, no 
permanent disabilities, no 
hospitalization. 

Repairable building damage, 
some operational downtime, 
immediate continuity of 
operations available off site. 



Minor building repairs 

Negligible (N) 

Negligible injuries. 

required, minimal operational 
downtime. 


In addition to ranking the consequences, risk binning analysis requires that the 
potential event frequency be estimated. In this method, the frequency analysis is based on 
the likelihood of an event causing damages that exceed the specified consequence (high, 
moderate, low, or negligible), rather than attempting to predict the occurrence of a 
specific scenario. Expected frequencies should be based on the analysis of fire incident 
data combined with professional experience. The SFPE Engineering Guide to 
Performance-Based Fire Protection borrows from the DOE’s facility safety analysis 
reports for the probability fonnulae employed in Table 19. 


Table 19. Sample Frequency Criteria Used for Probability Ranking (After: National 
Fire Protection Association & Society of Fire Protection Engineers, 2000) 


Frequency Description 


Frequency Level 
(Median Time to Event) 


Description 


Anticipated, expected 
(AE) 

>1 x 10' 2 /yr 
(<100 yr) 

Incidents that might occur 
several times during the 
lifetime of the building 
(incidents that occur 
commonly). 

Unlikely (Uni) 

1 x 10' 4 /yr <f< 1 x 10' 2 /yr 
(100-10,000 yr) 

Events not anticipated to 
occur during the lifetime of 
the facility. 71 


71 Natural phenomena of this probability class include the severest earthquake, a 100-year flood, or the 
maximum wind gust possible for the location where the building or facility occurs. 
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Frequency Description 

Frequency Level 
(Median Time to Event) 

Description 


1 x 10' 6 /yr <f< 1 x 10" 4 /yr 

Events that probably will not 

Extremely unlikely (EU) 

(10,000-1,000,000 yr) 

occur during the life cycle of 
the building. 

Beyond extremely 

<1 x 10' 6 /yr 

All other incidents. 

unlikely (BEU) 

(> 1,000,000 yr) 


Once the consequences and expected frequencies have been estimated, they are 
converted to a relative risk through the creation of a consequence-frequency matrix as 
shown in Figure 6. Each consequence-frequency combination is assigned a relative risk 
level from the application of Figure 6, and the results are considered bounding risks; 
those risks that the stakeholders determine are acceptable based on the prescribed 
conditions and cover 95% or more of all possible event outcomes. 


Frequency-* 

Consequence 

1 

BEU 

<1 x 10' 6 /yr 

EU 

10‘ 4 /yr <f< 

10" 6 /yr 

U 

10' 2 /yr <f< 10' 4 /yr 

AE 

>1 x 10' 2 /yr 

High 

10 a 

7 

4 

1 

Moderate 

8 

5 

2 

Low 

9 

6 

3 

Negligible 

11 

12 


| High risk Q Moderate risk Q Low risk Q Negligible risk 

a The numbers in the boxes are for identification only and do not imply a ranking. 


Figure 6. Sample Risk-Ranking Matrix for Risk Binning Analysis (After: National Fire 
Protection Association & Society of Fire Protection Engineers, 2000) 


As an example of how to apply risk binning analysis techniques, the stakeholders may 
determine that a worst-case arson fire scenario for their building or facility could result in 
the building being uninhabitable and that major equipment would be destroyed, but that 

111 
















continuity of operations plans (COOP) could be employed that allow operations to occur 
at another location. According to the Impact on Property/Operations column in Table 18, 
the consequences of such an event would be “moderate.” According to the baseline 
profile from the ISC DBT (2010), the arson threat to federal buildings is high and likely 
to occur during the life cycle of the building, which means an arson attack is anticipated 
or expected (See Table 19). In the Risk-Ranking Matrix for Risk Binning Analysis (Figure 
6), the cell at the intersection of the consequence row and the frequency column would 
conclude that for this scenario, an arson attack is a high risk to the building or facility. 

Another risk assessment tool commonly used in fire protection engineering is the 
detenninistic analysis approach, in which the expected perfonnance of the fire protection 
features is evaluated against one or more design fire scenarios (National Fire Protection 
Association & Society of Fire Protection Engineers, 2000). As conditions change during 
a fire (e.g., ignition, growth, flashover, or maximum heat output), they are plotted on a 
timeline along with critical events that occur with fire protection features in the building 
(e.g., smoke detector operation, sprinkler flow, or vent opening). Since it is expensive 
and time consuming to develop full-scale fire tests to demonstrate these conditions and 
assess their performance, computer fire models commonly are used as the tool to evaluate 
fire protection feature performance of the trial designs in the design fire scenarios. The 
trial designs must satisfy each perfonnance criterion (developed during Step 4 of the 
SFPE design model) to be considered successful. The number of variables that can be 
considered in the design fire scenario is significant—and all potential combinations of 
scenarios cannot be predicted—therefore, an uncertainty factor or safety analysis must be 
included in the analysis so the stakeholders can detennine the acceptable levels of risk 
that the trial designs may mitigate. 

According to the SFPE Engineering Guide to Performance-Based Fire 
Protection, “performance-based fire protection analysis and design relies on current 
scientific knowledge and the ability to perform accurate technical predictions” (p. 103). 
Like any discipline, fire protection engineering is in constant flux as the science and 
engineering knowledge of fire behavior and construction materials evolve. Therefore, 
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early performance-based designs did not have the benefit of current data or protocols to 
assure complete accuracy, and today’s designs do not enjoy the benefit of future research. 
Due to complexities in physical and chemical properties, currently, it is impossible to 
duplicate fire behavior in either laboratory or real-world conditions. While 
accommodating the evolution of the discipline and building confidence in the 
perfonnance-based approach, it must be recognized that these variables introduce 
uncertainty into any analysis. Since the science and engineering of fire behavior are not 
fully developed, uncertainty remains regarding how fires ignite and grow. Computer fire 
models used in detenninistic analysis, for example, are built upon observed behavior, but 
are not predictive of any specific scenario. Variables and errors in data inputs into 
computer model introduce additional uncertainty. The performance of building fire 
protection features as they interact with heat, flames, and smoke is not fully understood. 
Human behavior during fires and other emergencies varies with age, risk perception, 
cognition, socioeconomic status, and mobility; thus, it is impossible to predict how 
building occupants will respond to threatening conditions (Bryan, 2003). Combined, 
these uncertainties often demand a conservative approach to building design to increase 
confidence that safety and fire resistance are achieved, yet uncertainty can be reduced as 
improvements in measurement and perfonnance criteria specificity are achieved. 

G. SUMMARY 

In the last 50 years, the means and methods for building design and construction 
have changed dramatically. Not only have prescriptive designs and codes been 
modernized to address new building methods and materials, but interest has increased in 
the practice of performance-based design that emphasizes clearly defined fire safety 
perfonnance objectives rather than arbitrary rules. It is argued by many that greater 
adoption of perfonnance-based designs will result in creative architecture, reduced 
construction costs, and a higher degree of public safety. 

Key to the successful application of perfonnance-based design is the requirement 
to identify stakeholder objectives and their acceptable level of risk, and develop one or 
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more design solutions to satisfy them. The designs are evaluated against specific fire 
scenarios, often using sophisticated computer modeling techniques to represent fire 
behavior in a variety of conditions. It is essential that the fire scenarios are quantified to 
the extent possible so objective analysis of the trial designs can be accomplished. Since 
perfonnance-based design and the computer models often used to test design hypotheses 
are an inexact science, commonly accepted probabilistic and deterministic risk analysis 
techniques are employed to reduce the uncertainty associated with the proposed designs. 
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V. FIRE BEHAVIOR 


Fire is a complex thennodynamic chemical and physical phenomenon not entirely 
understood by scientists. The field of fire behavior studies is a relatively young discipline 
when compared to other scientific endeavors. Although ancient alchemists considered 
fire one of the earth’s fundamental elements, it is now known that combustion is a 
complex chemical reaction involving fuel (usually carbon or hydrocarbon-based 72 ), an 
oxidizing agent, and a competent heat source. When controlled, combustion is an 
essential part of day-to-day life; it is used to power motor vehicles, support industrial 
processes, and maintain environmental comfort. On the other hand, the destructive effects 
of unwanted fires kill and injure thousands and cause billions of dollars of direct property 
damage each year in the United States. This section provides an overview of fire behavior 
in the built environment to provide a framework for the application of fire effects 
modeling software to the research questions. It is not intended to be an exhaustive 
discussion of fire chemistry and physics. 

A. COMBUSTION 

In its simplest expression, fire involves the combination of a fuel, an oxidizing 
agent, and a competent ignition source in proper proportions to ignite and sustain the 
combustion process. It is an exothermic chemical reaction that produces enough energy 
to be perceived by humans or instruments. This energy release is manifested in the form 
of heat and light. 

Fuels can consist of many items in solid, liquid, or gaseous states. Whether the 
furniture in one’s home or office, gasoline in one’s motor vehicle, or methane that 
supplies a heating system, fuel is the source of latent energy that is released when ignited. 
The range of potential fuels in the built environment is very wide, from simple gaseous 
hydrocarbons to solids that have high molecular weight and complex chemical 


72 Containing atoms of hydrogen, carbon, oxygen and some nitrogen. 
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composition. Some of these materials are naturally occurring—such as cellulose—and 
others are manmade, such as gasoline, acetylene, ethanol, polyethylene, and 
polyurethane. Critical to fire behavior studies is the understanding that all combustion 
reactions release energy into the environment. This energy release is described in fire 
behavior studies as the heat of combustion, or the total amount of heat released when a 
unit of fuel (at 77°F and normal atmospheric pressure [25°C and 1 bar]) is completely 
oxidized in controlled conditions (Drysdale, 1998). The energy released is measured in 
kilojoules per gram (kJ/g) 73 and is represented by the expression A// c . Table 20 provides 
a sample representation of the heat of combustion and chemical formulae of specific 
fuels. (Polystyrene and polyethylene, common manmade components in modern furniture 
fabrics, are described as possessing variable chemical formulae as a result of differences 
in manufacturing processes). Higher numerical values represent more potential heat 
energy that may be released from the fuel; therefore, higher numerical values translate 
into greater challenges for fire protection systems and suppression forces to control or 
suppress a fire in these fuels. 

Table 20. Heat of Combustion of Specific Fuels (After: Drysdale, 1998) 


Fuel 

Chemical Formula 

A H c 

(kJ/g) 

Dextrose 

c 6 h 12 0 6 

15.40 

Cellulose 3 

(C 6 H 10 O 5 ) n 

16.09 

Ethanol 

C 2 H 5 OH 

26.78 

Acetone 

(CH 3 ) 2 CO 

30.79 

Polystyrene 

Variable b 

39.85 

Benzene 

c 6 h 6 

40.00 

Kerosene 

c 12 h 26 

43.00 

Polyethylene 

Variable 

43.28 


73 Fire behavior studies commonly are conducted in the International System of Units (SI). See 
Appendix A for conversion to the United States customary system. 
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Fuel 

Chemical Formula 

A H c 

(kJ/g) 

Diesel (Fuel Oil No. 2) 

Variable 

44.00 

Propane 

c 3 h 8 

46.45 

Gasoline 

Variable 

47.30 

Methane 

ch 4 

50.00 

Ethene 

c 2 h 4 

50.35 


a A generic formula for cellulosic materials, such as wood, paper, or 
cotton. 

b Many of these products are subject to changes in their chemical 
formulas during the refining or manufacturing process. 

An important distinction in fire studies is the difference between heat and 
temperature. Heat is the amount of energy transferred from one object to another due to 
differences in temperature. Temperature, represented by degrees in the Fahrenheit, 
Celsius, Kelvin, or Rankine scales, is simply a measurement of a material’s molecular 
activity compared to a reference point. As an object or fuel absorbs energy from the 
environment or another object, molecular activity increases. The change in molecular 
activity is registered as temperature. Table 21 provides an example of temperatures and 
the corresponding physical or physiological response. 


Table 21. Temperature Examples and Corresponding Physical or Physiological 

Response (After: Fire Behavior, 2011) 


Temperature 

°F 

Temperature 

°C 

Response 

98.6 

37 

Normal human oral/body temperature 

111 

44 

Human skin begins to feel pain 

118 

48 

Human skin receives a first degree bum injury 

131 

55 

Human skin receives a second degree bum injury 

140 

62 

Burned human tissue becomes numb 

162 

72 

Human skin is instantly destroyed 
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Temperature 

°F 

Temperature 

°C 

Response 

212 

100 

Water boils and produces steam 

284 

140 

Glass transition temperature of polycarbonate 

446 

230 

Melting temperature of polycarbonate 

482 

250 

Charring of natural cotton begins 

>572 

>300 

Charring of modem fire fighter protective 
clothing begins 

>1112 

>600 

Temperatures inside a post-flashover room fire 


Fuels, especially solids and liquids, may have to undergo a physical change before 
they can be ignited. For combustion to occur, the combustible constituents of the fuel 
must exist in a gaseous state during which they can be mixed with oxygen and create a 
fuel-to-oxygen ratio where they ignite and sustain combustion. Wood products and most 
liquid fuels, for example, must be heated to release the volatile hydrocarbon elements that 
eventually burn. 74 This thermal decomposition is known as pyrolysis. When the 
flammable constituents exist in a proportion with oxygen that will sustain combustion, 
the mixture is known as the flammable limits or flammable range. If the ratio of fuel to 
oxygen is too little to bum, the mixture is considered “too lean,” and conversely, if the 
amount of fuel in proportion to oxygen is too great, the mixture is considered “too rich.” 

Oxidizing agents may exist in solid, liquid or gas phases, and provide the 
necessary oxygen to support combustion. Fires in the built environment require 
approximately 15-16% oxygen by volume to sustain combustion, and the air humans 
breathe contains approximately 21% oxygen by volume; 75 thus, in most building fires, a 
generous supply of oxygen is available to support combustion. In addition, numerous 
industrial and production chemicals contain oxygen molecules that can be released during 
combustion, which therefore adds to the available oxygen in the environment. For 

74 Gaseous fuels, e.g., methane and hydrogen, already exist in the physical state that enables them to 
mix with oxygen. 

75 The remainder is approximately 78% nitrogen and 1% trace elements. 
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example, solid inorganic nitrates (sodium nitrate, potassium nitrate, and ammonium 
nitrate) can melt and release oxygen and cause a fire to intensify. Furthermore, molten 
nitrates react with carbon-based organic materials “with considerable violence, usually 
releasing toxic oxides of nitrogen” (Davenport, 2003). A universally familiar example of 
inorganic nitrates used in criminal or terrorist acts was the 1995 truck bombing of the 
Alfred P. Murrah Federal Building in Oklahoma City that was destroyed by a mixture of 
diesel fuel (a hydrocarbon) and ammonium nitrate. 76 In fact, the combination of these 
products is used routinely as a commercial blasting agent called ANFO, which is an 
acronym for ammonium nitrate-fuel oil. Other oxidizing chemicals that can easily be 
found in industrial or retail markets include hydrogen peroxide, potassium chlorate, 
sodium peroxide, ammonium perchlorate, potassium pennanganate, and potassium 
persulfate (Davenport, 2003). 

The number and variety of ignition sources is substantial. Overall, these sources 
are divided into two major categories, piloted ignition and autoignition (Quintiere, 1998). 
In piloted ignition, a heat source, such as a spark or flame, ignites the fuel in the presence 
of the oxidizing agent. An electrical spark igniting gasoline vapors is an example of 
piloted ignition. Likewise, an IID placed in or near a target by a criminal or terrorist 
adversary generally employs piloted ignition methods, such as an open flame or spark. 
Autoignition, in contrast, is ignition that occurs absent a spark or flame, and often is the 
result of chemical decomposition of fuels. Wet, baled hay is well known for autoignition, 
and results in what is commonly called spontaneous combustion and is responsible for 
numerous barn fires in agricultural areas. What is important to remember is that the 
energy required to ignite flammable mixtures is low—a few tenths of a millijoule 77 (mJ) 
for mixtures in air—thereby, increasing the likelihood that when a flammable mixture 
exists, it can be ignited easily (Beyler, 1995). For combustion to occur, four conditions 
must exist. 


76 More recently, a fire-induced ammonium nitrate explosion in West, Texas resulted in 14 deaths, 
including 10 first responders (Karimi& Grinberg, 2013). 

77 Approximately 0.0002388459 calorie. See Appendix A for conversion to the U.S. customary 
system. 
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• The fuel must exist in a condition within its flammable range 

• The ignition source must have sufficient energy to ignite the target fuel 

• There must be contact between the ignition source while the fuel is within 
its flammable range 

• The duration of the contact must be sufficient to exchange energy from the 
ignition source to the fuel (U.S. Fire Administration, 2010b) 

B. FIRE BEHAVIOR AND EFFECTS IN COMPARTMENTS 

Given the nearly unlimited potential combinations that exist in fuels, oxidizing 
agents, and ignition sources, combustion science is complex, and remains a challenging 
and evolving field of study. While a detailed understanding of the physics and chemistry 
of fire ignition is important to many parts of the scientific community, for the purpose of 
this thesis, the effects of sustained, unwanted fires are significant to comprehend the 
problem being studied. 

The term “unwanted fires” describes those events either unanticipated or criminal 
in nature, and result in some insult to humans or the built environment. When an 
unwanted fire occurs in an enclosed space, 78 its effects are identifiable by a set of 
generally deterministic and observable characteristics. Granted, the nature and 
complexities of interactions among the fuels, oxygen supplies, and ignition sources are 
almost limitless, but fire behavior can be observed in several consistent ways. Under 
laboratory conditions, complete combustion results in the total consumption of the fuel, 
with only heat, carbon dioxide and water vapor being emitted (Drysdale, 1998). 
However, in the built environment, conditions rarely exist for complete combustion, and 
therefore, fires will emit burned and unburned constituents that result in smoke and other 
toxic gases, such as carbon monoxide and hydrogen cyanide. For the purpose of the 


78 When describing fires in the built environment, it is assumed they are occurring in a three- 
dimensional space that usually consists of a floor, enclosing walls, and a ceiling. While these spaces can 
assume almost limitless configurations, for the purposes of fire studies, they may be called compartments, 
envelopes, rooms, or the built environment to represent the spatial relationships. 
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following summary discussion, it is assumed that adequate fuel, oxygen, and a reliable 
ignition source exist in appropriate conditions to initiate and sustain a fire within a 
compartment. 79 

Once ignited, a fire will continue to grow until it reaches extinction by consuming 
all the available fuel or oxygen in the surroundings (however, is not the same as the 
laboratory definition of complete combustion), or if the fire is interrupted by suppression 
efforts. Figure 7 represents the relationship between temperature and time in the various 
stages of compartment fire development. Note that for illustrative purposes, the x and y 
axes are dimensionless. Values are dependent on specific fire conditions and the 
geometry of the compartment. 



Figure 7. Relationship of Temperature and Time in Compartment Fire Development 

(From: Fire Behavior, 2011) 

As the fire increases in size, and combustible materials decompose through 
pyrolysis, the ensuing visible flame and smoke become buoyant. This vertical flame 
spread is called the fire plume and delineates the area in which flaming combustion is 

79 Fire behavior may be influenced by the amount of fuel or ventilation available in a compartment, or 
affected by the operation of a fire protection system, such as an automatic sprinkler system. The 
multiplicity of possible permutations is outside the scope of this study. 
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occurring. Heat from the chemical reaction within the plume increases the activity of 
electrons of the fuel’s atoms, and this increased movement results in the emission of 
energy waves visible to humans (Gorbett & Pharr, 2011). As the hot gases rise, cooler air 
is induced to flow into the bottom of the fire plume. This process is called entrainment, 
and is responsible for flame height and turbulence. Temperatures within the fire plume 
vary across the plume’s width with the highest temperatures found at the center of the 
plume (Quintiere, 1998). 

Heat transfer from the fire source to a target, such as furniture, draperies, wall 
coverings, or other combustible objects, enhances pyrolysis. The amount of energy 
transmitted to a unit of the target area over a quantified time unit is called heat flux, 
which is an important measure to detennine for whether combustible targets can be 
ignited. It is normally measured in kilowatts (kW)/m“, kilojoules (kJ)/m or 
Btu/ft -second. The amount of energy needed to ignite targets varies depending upon the 
target’s ability to absorb heat and its material composition. Table 22 provides examples 
of materials and the corresponding critical radiant heat flux needed for ignition. Solid 
fuels are generically classified as thermally thick or thin depending upon their ability to 
absorb heat energy and transfer it throughout the object. Based upon their chemical and 
physical composition, materials need not be physically thicker or thinner than one 
another, but thermally thick solids absorb heat energy more quickly and do not transfer it 
as quickly as thermally thin objects do (Gorbett & Pharr, 2011). The likelihood of 
ignition of thermally thick or thin materials can be predicted through complex 
mathematical equations. 
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Table 22. Critical Radiant Heat Flux Needed for Ignition (After: Society of Fire 
Protection Engineers: Task Group on Engineering Practices, 2002) 


Material 

Thickness 

(in.) 

Thickness 

(mm) 

Critical 
Radiant 
Heat Flux 
(Btu/ft 2 -sec) 

Critical 
Radiant Heat 
Flux (kW/m 2 ) 

Polymethyl methacrylate 3 

5/8 

15.9 

0.793 

9 

Hardboard 

1/4 

6.35 

0.881 

10 

Carpet, acrylic 

NR 

NR b 

0.881 

10 

Fiber insulation board 

NR 

NR 

1.233 

14 

Hardboard 

1/8 

3.175 

1.233 

14 

PMMA (Type G) 

1/2 

12.7 

1.321 

15 

Asphalt shingle 

NR 

NR 

1.321 

15 

Douglas fir particle board 

1/2 

12.7 

1.409 

16 

Plywood, plain 

1/2 

12.7 

1.409 

16 

Plywood, plain 

1/4 

6.35 

1.409 

16 

Foam, flexible 

1 

25.4 

1.409 

16 

Glass-reinforced plastic 

1/12 

2.24 

1.409 

16 

Hardboard, gloss paint 

1/8 

3.4 

1.497 

17 

Hardboard, nitrocellulose 
paint 

NR 

NR 

1.497 

17 

Glass-reinforced plastic 

3/64 

1.14 

1.497 

17 

Particle board, stock 

1/2 

12.7 

1.586 

18 

Carpet, nylon/wool blend 

NR 

NR 

1.586 

18 

Gypsum board, wallboard 

NR 

NR 

1.586 

18 

Carpet, wool, untreated 

NR 

NR 

1.762 

20 

Foam, rigid 

1 

25.4 

1.762 

20 

Fiberglass shingle 

NR 

NR 

1.850 

21 

Polyisocyanurate 

2 

50.8 

1.850 

21 
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Material 

Thickness 

(in.) 

Thickness 

(mm) 

Critical 
Radiant 
Heat Flux 
(Btu/ft 2 -sec) 

Critical 
Radiant Heat 
Flux (kW/m 2 ) 

Carpet, wool,treated 

NR 

NR 

1.938 

22 

Carpet, wool, stock 

NR 

NR 

2.026 

23 

Aircraft panel, epoxy 
Fiberite c 

NR 

NR 

2.467 

28 

Gypsum board, fire-rated 

1/2 

12.7 

2.467 

28 

Polycarbonate 

19/32 

1.52 

2.643 

30 

Gypsum board, common 

1/2 

12.7 

3.083 

35 

Plywood, fire retardant 

1/2 

12.7 

3.877 

44 

Polystyrene 

2 

50.8 

4.053 

46 


Also known as PMMA, a plastic commonly used in eyewear lenses. 
b Not reported. 

c Fiberite is a trade name for a mineral filled epoxy resin. 


According to Babrauskas (1983), “especially easily ignitable” items ignite at 
critical radiant flux of 10 kW/rn", “normal” ignitability occurs at 20 kW/rrT, while 
“difficult to ignite” objects correspond to 40 kW/nf, including primarily slow burning 
items, such as institutional and office furniture (p. 25). 

Flame temperatures in compartments show surprisingly consistent values despite 
variations in contents and ventilation. Areas may exist in which 1,652°F (900°C) flame 
temperatures are observed, but wide variations will occur. The peak fire temperature 
normally associated with compartment fires turns out to be around 2,192°F (1,200°C), 
although a typical post-flashover room fire will more commonly be 1,652-1,832°F (900 
to 1,000°C) (Babrauskas, 2006). 

Smoke, which Mulholland (1995) defines as “the smoke aerosol or condensed 
phase component of the products of combustion,” is the visible fire component in which 
unbumed carbon particulate and other toxic gases accumulate (p. 2-217). According to 

Mulholland, “smoke aerosols vary widely in appearance and structure, from light colored, 
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for droplets produced during smoldering combustion and fuel pyrolysis, to black, for 
solid, carbonaceous particulate or soot produced during flaming combustion” (p. 2-217). 
This description of smoke opacity has important consequences that explain one way heat 
is transferred in a compartment fire. 

In addition to fire spread through direct flame contact, heat energy is transmitted 
through conduction, convection, and radiation. Conduction is the transfer of heat due to 
molecular energy; heat is transferred through the material by increased molecular 
activity. The heat felt when holding a ceramic cup of hot liquid is the result of conductive 
heat transfer. Convection is heat transfer from a moving fluid (liquid or gas) onto a solid 
surface, such as what is experienced when holding a hand above an electric or gas 
cooking range element. Radiation is heat transfer through electromagnetic energy. The 
heat absorbed from the sun is an example of the effect of radiation. 

If a fire possesses adequate energy to reach the ceiling of the compartment, the 
flames and other products of combustion will travel outward in all directions 80 from the 
centerline of the fire plume. This horizontal fire spread is called a ceiling jet and has a 
significant influence on heat transfer, as well as fire protection systems, such as detection 
devices, or automatic sprinklers. As the volume of smoke and heated gases increase in a 
compartment, the opacity of the smoke affects heat transfer back into the lower levels of 
the compartment. Mulholland reported in 1995 “a large fraction of the radiant energy 
emitted from a fire results from the blackbody emission from the soot in the flame” 
(p. 2-217). This heat energy radiates back into the compartment and increases the rate of 
pyrolysis of combustible materials. According to Custer (2003), the temperature of the 
ceiling jet will decrease as its radius increases due to heat losses to the ceiling and to the 
entrainment of cooler air from the surroundings, and thus, loses energy as it gets farther 
from the influences of the fire plume. 


80 Assuming the compartment has a smooth, flat ceiling. Ceilings that slope or have architectural 
features (e.g., beams, soffits, decorations) may affect ceiling jets differently. 
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As the ceiling jet travels across the surface, the heated gases and other products of 
combustion interact with the fire protection systems if present. These fire products cause 
automatic detection devices, such as sprinklers and heat detectors, to respond to thennal 
changes, and smoke detection devices to sense other products of combustion. 

To be usable, spaces within the built environment generally have openings in the 
form of windows or doors to provide human access or comfort. These openings affect 
compartment fire behavior by influencing a fire’s ventilation and its ability to use oxygen 
for continued combustion. As the temperature of fire gases increase, they expand and 
create rising pressure in the compartment. 81 The pressure difference between one 
compartment and another (or indoors and outdoors) accounts for the movement of smoke 
and other products of combustion away from the fire source at higher levels of the 
compartment. Simultaneously, cooler air will enter the enclosure at the lower level, often 
creating what appear to be two distinct layers of burning and non-buming environments. 
Over time, this upper layer will descend toward the floor as the volume of smoke 
increases with continuous combustion. As long as the fire continues to grow and spread, 
the upper layer descends toward the floor and the fire inside the compartment will 
maintain positive pressure to push the smoke out. If the fire consumes most of the 
enclosure’s oxygen, however, and begins to subside, the inside pressure will drop below 
the outside pressure and more air will flow into the space, often resulting in increased 
combustion, which can occur in a cyclical manner with the result being a compartment 
fire that appears to be breathing as the air rushes in and smoke pushes out (Gorbett & 
Pharr, 2011). 

Unregulated fire behavior often is characterized as fuel-controlled or ventilation- 
controlled. According to Gorbett and Pharr (2011), a “fuel controlled enclosure fire is 
one that is not adversely affected by the availability of oxygen until the fire nears full- 
room involvement and is limited only by the availability of fuel in a ready state for 
combustion” (p. 237). The fire is controlled by the fact that when the fuel is consumed, 
the fire will diminish toward extinction. A ventilation-controlled fire, on the other hand, 

81 Following the principles of the ideal gas law. 
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suffers from an inadequate supply of oxygen and may decay toward extinction. Most fires 
begin as fuel-controlled, but may become ventilation-controlled in the absence of an 
adequate air or oxygen supply (Gorbett & Pharr, 2011). 

Given an adequate fuel supply, a ventilation fire will proceed to burn to flashover, 
the point, according to Thomas (P. H. Thomas, 1983), where the fire transitions from a 
localized fire to a general conflagration within the compartment in which all fuel surfaces 
are burning, the fire transitions from fuel-controlled to ventilation-controlled, and there is 
a sudden propagation of flame through the unbumed gases and vapors collected under the 
ceiling. Depending upon conditions, flashover typically occurs at about 932-1,112°F 
(500-600°C) and may last several seconds. Peacock, Reneke, Bukowski, and 
Barbrauskas (1999) concluded that given the wide variety of experimental data, the 
definition of flashover for fire hazard calculations should include an upper gas 
temperature of equal to or greater than 1,112°F (600°C) or a heat flux at floor level of 
greater than or equal to 20 kW/m". “After flashover has occurred, the exposed surfaces of 
all combustible items in the room of origin will be burning, and the rate of heat release 82 
will develop to a maximum, producing high temperatures” (Drysdale, 1998, p. 325). 

According to Babrauskas and Peacock (1992), the HRR is the single most 
important variable in a fire. HRR describes the amount of heat released over a unit of 
time by one or more burning objects. The energy release commonly is expressed in watts 
(W), kilowatts (kW), or megawatts (MW). 83 Generally, HRR provides fire safety 
professionals a means to quantify fire behavior so it can be compared to other events, 
especially in computerized fire modeling applications. Babrauskas and Peacock (as cited 
in Icove & DeHaan, 2009) reported that HRR is “essentially the size or power of the fire. 


8 - Also known as heat release rate (identified with the acronym HRR), it is represented by the symbol 
Q where the dot over the Q means per unit time. 

83 A watt is the amount power dissipated by a current of one ampere flowing across a resistance of one 
ohm. A kilowatt equals 1,000 watts. A megawatt equals 1,000 kilowatts. 
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. . . First, and most important, heat released by a fire is the driving force 
for that fire subsequently to produce more heat by producing more fuel by 
evaporation or pyrolysis .... Second, another important role of the heat 
release rate ... is that it directly correlates with many other variables. 
Examples include the production of smoke and toxic by-products of 
combustion, room temperature, heat flux, mass loss rates, and flame height 
impingement. 

Third, the direct correlation of heat release rates and lethality of a fire is 
significant. High heat fluxes, large volumes of high-temperature smoke, 
and toxic gases may overwhelm occupants, preventing their safe escape 
during fires, (p. 66) 

Table 23 provides examples of peak heat release rates for common objects. 


Table 23. Peak Heat Release Rates for Common Objects (After: Icove & DeHaan, 
2009, p. 67; Bounagui, Benichou, & Kashef, 2005, pp. 2-3; Madrzykowski, 

1996, p. 49) 


Material 

Peak Heat Release Rate 
(kW) 

Cigarette 

.005 (5 W) 

Wooden kitchen match or cigarette lighter 

.050 (50 W) 

Candle 

.05-08 (50-80 W) 

Bookcase, plywood with aluminum frame 

25 

Wastepaper basket (0.94 kg) 

50 

Office wastebasket with paper 

50-150 

Latex foam pillow (1.24 kg) 

117 

Small chair with some padding 

150-250 

Television set (39.8 kg) 

290 

Modern armchair (41.8 kg) 

350 kW-1.2 MW 

Recliner with synthetic padding and covering 

500-1 000 (1MW) 

Natural Christmas tree (7.0 kg) 

650 

Molded plastic chair (11.26 kg) 

700 

Metal wardrobe (41.4 kg) 

750 

Gasoline pool (1.89 L, on concrete) 

1 MW 

Christmas tree (dry, 1.83 to 2.1 m) 

1-5 MW 
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Material 

Peak Heat Release Rate 

(kW) 

Sofa with synthetic padding and covering 

1-3 MW 

Plywood wardrobe with fabric 

3-6 MW 

Living room or bedroom (fully involved) 

3-10 MW 

Office workstation with privacy panels 

2.8-6.9 MW 


While Figure 7 may represent the fire growth and extinction of a typical 
compartment fire, current research shows that fire growth and its corresponding energy 
release is heavily dependent on the nature of the fuel consumed. Citing research 
conducted by the Factory Mutual Research Corporation, Evans (1995) reported that fire 
growth and HRR might be assumed to occur in four general categories: ultra-fast, fast, 
medium, and slow that describe the correlation between time and their maximum HRR. 
in these categories, the HRR grows proportionately to the square of time, and have 
become known as t-squared (t ) fires. According to Fleming (2003): 

fn the 1980s, fire protection scientists and engineers introduced the 
concepts of “slow,” “medium,” and “fast” t-squared fires to represent a 
range of expected rates of heat release for fire modeling. Basically, a slow 
t-squared fire reaches a burning rate of 1,000 Btu/s (1 055 kW) in 600 
seconds, while a medium t-squared fire reaches that rate in 300 seconds 
and a fast fire in 150 seconds. 

The concept of the ultra-fast t-squared fire was introduced shortly after the 
concepts of the slow, medium, and fast fires when it became apparent that 
the range of those three design fires wasn’t sufficient to capture some of 
the more important fire challenges. The ultra-fast t-squared fire reaches 
the burning rate of 1,000 Btu/s (1,055 kW) in 75 seconds, (p. 26) 

Fleming’s comment that the t fires are used in fire modeling explains how in 
Table 17—Design Fire Scenarios from NFPA 101, Life Safety Code—the various fire 
scenarios are employed for the purposes of evaluating performance-based designs. Figure 
8 illustrates the four t HRR curves with examples of the products tested to obtain the 
results. 
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Thin Plywood stacked 
Wardrobe p a | tets 



2 

Figure 8. Heat Release Rate (HRR) Curves for Sample t Fires (From: Fire Behavior, 

2011) 


C. SMOKE AND TOXICITY 

While the dramatic visual effect of a fire’s flames is impressive, the real threat to 
human survivability is smoke. According to Hall (2011), between 51% and 73% of fire 
deaths are attributable to smoke inhalation alone, while the combined effect of smoke 
inhalation and bums is about 74%. Most fire deaths (85%) occur in residential settings, 
yet since 2003, an average 109 people die in non-residential fires each year and the data 
show a recent trend upward (Karter, 2010). This thesis explores these non-residential 
buildings and facilities in which occupants are assumed to be expected to be awake, alert, 
oriented to their surroundings, and capable of self-preservation, or by assistance from 
others. 

Smoke is emitted from a fire when the combustion process is not complete, as is 
typical of most fires outside controlled laboratory environments. Smoke may contain 
unbumed particulate matter, toxic fire gases, water vapor, and other constituents 
transported away from the fire by convection. Butler and Mullholland (2004) reported 

that increasing concern exists about the less-than-lethal effects of smoke generated by 
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fires even in those environments —such as the workplace—in which exposed persons 
may be fully cognizant of their surroundings and capable of self-preservation. 

The eye and lung irritation due to irritant gases and aerosols and the 
confusion due to asphyxiants may slow escape or cause incapacitation. 

The inhalation of a large concentration of soot and toxic gases may lead to 
lung edema and inflammation, causing death a short time after the fire (p. 

149). 

The number and potential combinations of lethal and sub-lethal combustion products 
found in smoke is limited only by the combination of fuels burning and the environment 
in which they occur. Hundreds of studies have been conducted throughout the world to 
assess smoke constituents and their lethality (See Levin & Kuligowski, 2005; Gann, 
1992; Gann, 2001; Pitts, 2001). According to Purser’s review (1995), two critical 
observations about fire product toxicity are known: 1) in environments in which fires 
occur, a large number of potentially toxic products occur depending upon the chemical 
decomposition of the burning material and the available oxygen, and 2) despite the huge 
potential of variable conditions, “the basic toxic effects were relatively simple. For each 
individual smoke atmosphere the toxicity was dominated either by a narcotic 
(asphyxiant) gas [CO or HCN] 84 or by irritants” (p. 2-87). Gann (2008) added very 
succinctly, “of the sublethal [sic] effects of fire effluent, incapacitation is frequently 
tantamount to lethality. If a person is rendered unable to effect his or her own escape, and 
if the fire and its effluent continue to spread, the person’s survival is threatened” (p. 4). 

The toxicity of smoke products generally is described in tenns of its lethal 
concentration and is standardized for comparison by the descriptor LC50.. 85 Doses are 
measured in parts per million in the volume of the compartment under study (ppmv); the 
lower the LC50 value, the more toxic the product. It might be assumed, however, that 

84 CO is the chemical formula for carbon monoxide, and HCN is the chemical formula for hydrogen 
cyanide. 

8 ^ The LC 50 value is the result of statistic calculation based on multiple experiments, each with 
multiple animals, and indicates the concentration at which 50% of the experimental animals exposed for a 
specific length of time would be expected to die either during the exposure time of the post-exposure 
observation period (Levin & Kuligowski, p. 210). For fire toxicity data, the exposure period normally used 
is 30 minutes (Babrauskas, 1997). 
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people who are alert and oriented would be expected to evacuate or seek shelter before 
being exposed to lethal concentrations of toxic gases. According to Babrauskas (1997), 
concentrations of toxic gases that have a narcotic effect and may incapacitate a person to 
compromise or prevent the self-evacuation are important, but are problematic to 
determine. Another value, the hypothetical incapacitation level—referred to as the 
effective concentration (EC50) —has been recommended by National Institute of 
Standards and Technology (NIST) in reducing the LC50 by two to four times. Table 24 
lists a few of the known toxic products of combustion and their lethal and effective 
concentrations. 


Table 24. Lethal and Effective Concentrations of Some Toxic Products of Combustion 

(After: Babrauskas, 1997) 


Gas 

Assumed 3 

human 

LC 50 
(5 min) 

Assumed 
human LC 5 o 
(30 min) 

Assumed 

ec 50 

(5 min) 

Assumed 

ec 50 

(30 min) 

Carbon dioxide 

>150,000 

>150,000 

- 

- 

Acetaldehyde 

- 

20,000 

- 

- 

Ammonia 

20,000 

9,000 

m b : 20,000 

r: 10,000 

m: 4,400 

r: 4,000 

Hydrogen chloride 

16,000 

3,700 

- 

- 

Carbon monoxide 

- 

3,000 

- 

- 

Hydrogen bromide 

- 

3,000 

- 

- 

Nitric oxide 

10,000 

2,500 

- 

- 

Carbonyl sulfide 

- 

2,000 

~ 

- 

Hydrogen sulfide 

- 

2,000 

- 

- 

Hydrogen fluoride 

10,000 

2,000 

- 

- 

Acrylonitrile 

- 

2,000 

- 

- 

Carbonyl fluoride 

- 

750 

- 

- 

Nitrogen dioxide 

5,000 

500 

m: 2,500 

r: 5,000 

m: 700 

r: 300 

Acrolein 

750 

300 

- 

- 

Formaldehyde 

- 

250 

~ 

- 

Sulfur dioxide 

500 

— 

— 

— 
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Gas 

Assumed 3 

human 

LC 50 
(5 min) 

Assumed 
human LQ 0 
(30 min) 

Assumed 
EQo 
(5 min) 

Assumed 
EC S0 
(30 min) 

Hydrogen cyanide 

280 

135 



Toluene diisocyanate 

- 

100 

~ 

- 

Phosgene 

50 

90 

- 

- 

Perfluoroisobutylene 

28 

6 

— 

— 


J A11 units are reported in parts per million by volume (ppmv). 

b 

m = mouse, r = rat. 


In a more recent study, using computer modeling, 86 Peacock, Averill, Reneke and 
Jones (2004) found that for fires that had not reached flashover, within the room in which 
the fire starts, the incapacitation from heat generally will occur before narcotic gas 
concentrations reach even 1% of lethal conditions. 87 Importantly, they found that once 
outside the room of origin—especially in buildings with large rooms—smoke is diluted 
rapidly and the smoke exposure effects would occur well after a victim is incapacitated 
by heat. In “residential buildings and other buildings with ordinary size rooms, 
incapacitation from smoke inhalation will rarely occur before incapacitation from heat 
and thermal radiation or escape or rescue” (p. 145). This claim is significant and is based 
on modeling that should be compared to real-world results. 

Another concern about smoke is its effect on visual acuity and the ability of 
people who are trying to escape a fire to negotiate the means of egress to safety. In her 
2009 meta-analysis, Kuligowski (2009) found limited visibility caused by smoke could 
affect both an individual’s ability to escape a building with the corollary outcome that a 
decrease in walking speed could affect both an individual’s ability to escape and the 
subsequent ability to move around a building to perfonn a work task or tasks. According 
to Kuligowski’s research: 


86 They modeled prototypical ranch house, hotel, and office configurations, all of which comprised 
one-story scenarios. 

87 “The exception to this involves smoldering fires that generate little heat and, with little buoyancy to 
drive mixing throughout the space, can readily generate incapacitating exposures, especially for occupants 
intimate to the smoldering item” (p. 144). 
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A high smoke obscuration is likely to affect an individual’s safety in a 
building. Exposures to thick, dense smoke can negatively affect an 
individual’s ability to see their surrounding environment, and in turn, 
affect their speed of movement throughout a smoke-filled space and their 
concentration on a job task. The density of the smoke itself affects 
visibility as well as the irritancy of the smoke. In some cases, irritants can 
be so potent that individuals cannot open their eyes to see. (p. 31) 

The importance of understanding the relationship between smoke toxicity and 
obscuration is its role in affecting escape time. In the mid-1970s, fire protection 
professionals began employing the concepts of required safe egress time (RSET) and 
available safe egress time (ASET). In theory, building occupants—once notified or 
becoming aware of a threat, such as a fire—required a certain amount of time (the RSET) 
to respond to the threatening cues and take appropriate action to evacuate the premises. 
Empirical studies and mathematical human evacuation models led to the ASET concept 
that measured the amount of time available for egress before the occupant was in 
imminent danger. If combined fire effects and evacuation models showed that the ASET 
was less than the RSET (occupants could escape before encountering fire or smoke), the 
means of egress design was deemed to comply with the perfonnance requirements of the 
building or fire codes. 

According to Chu, Sun, Sun, Chen, and Chen (n.d.) tenability is lost when 
occupant incapacitation is predicted from exposure to smoke. 

ASET is dominated by ignition, fire growth and the spread of fire and fire 
smoke. These depend upon a range of variables, such as fire load, the 
reaction to fire properties of the lining materials and contents, the height 
and ventilation of the compartment and the characteristics of the fire 
effluent, (p. 351) 

By comparison, “RSET is related to fire detection and alann, occupant characteristics 
(such as age, sex, physical and mental ability, sleeping or waking, population density), 
human behavior in fire (such as seeking information, collecting belongings, choosing an 
exit) and building characteristics (such as corridor width, exit numbers and widths)” (p. 
351). Chu et al. (n.d.) developed a simple timeline diagram to illustrate the relationship 
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between ASET and RSET (Figure 9). The vertical line at the left of the illustration 
represents the time at which a fire ignites, and the subsequent events are to the right of 
this vertical line. 



Figure 9. ASET and RSET Comparative Timeline (After: Chu et ah, n.d.) 


where 

td = time from ignition to detection 

4 = time to alann operation and notification 

t p = occupant pre-movement time 88 

t m = occupant movement time to travel to a place of safety 

Recently, Babrauskas, Fleming and Russell (2010) expressed criticism that the 
RSET/ASET concept was overly simplistic and could not anticipate the broad of 
conditions, capabilities, and constraints that building occupants might face in fires. 
Babrauskas et al. (2010) recommended that the RSET/ASET concept be abandoned in 
favor of other analytical tools that employ a comparative margin of safety analysis, but at 
this time, those tools do not exist. Chu et al. (n.d.) agreed that for RSET calculations, 
“occupant pre-movement time is often ignored or oversimplified to be defined as an 


88 The time after an alarm or cue (such as smoke or eyewitness reports of a fire) is evident but before 
the occupants of a building begin to move towards an exit. 
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explicit value in fire risk assessment. In fact, occupant pre-evacuation time is not an 
explicit value but a random variable which follows some probability distribution” (p. 
352). 

D. SUMMARY 

Fire is a complex thermodynamic chemical and physical phenomenon not entirely 
understood by scientists or fire protection engineers. The almost incalculable 
combination of fuels, ventilation, and ignition sources, and the nearly limitless potential 
configurations of building materials and designs, makes detailed scientific analysis 
complicated. The effects of solid, liquid, or gas fuels, how they are arrayed in a 
compartment, and their interaction with one another in fire conditions, are subjects for 
study beyond this thesis. The purpose of this overview is to prepare the reader to be 
familiar with the data inputs and ranges of possible results that occur in the fire modeling 
applications of the thesis research. 
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VI. FIRE AS A WEAPON 


Fire has been used as a weapon for millennia. The ease with which it can be 
started, and the significant damage it can cause, makes it a useful tool to threaten or 
destroy enemies. News articles and journals continue to be filled with references to using 
fire as a weapon in a variety of venues. In May 2012, A1 Qaeda’s English language 
magazine Inspire included a how-to article encouraging adherents to set fires in 
America’s wildland-urban interface to create fright and cause significant economic 
disruption. 

Our Prophet mentioned to use that the weapon of fright is among the 
strongest weapons which the Muslim ummah of Muhammad is 
distinguished with. 

. . . fire is one of the soldiers of Allah which He sends upon the 
disbelievers and controlling it is all cases is impossible, because if the 
Almighty Allah commanded to destroy, He destroys. (AQ Chef, 2012, p. 

35) 

A second article in the same Inspire issue provided religious justification for arson 
through a Sharia ruling stating, “. . . it is ok to bum their fortresses with fire, to drown 
them with water and to ruin and demolish them. . .” (al Nadari, 2012, p. 46). 

Despite the fact that in recent years the leading cause of fires in non-military 
federal buildings was some sort of electrical malfunction, concern still exists regarding 
malicious acts against federal properties. The sheer number of federal properties and the 
often-easy access that the public has to them creates a vulnerable environment that is a 
challenge to protect. According to the ISC DBT , the threat to federal facilities from a fire 
attack is real. 

This section provides an overview of the use of fire as a weapon with IID in the 
built environment, and looks at some of the current and emerging threats to federal 
buildings and facilities. 
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A. FIRE ATTACKS ON FEDERAL FACILITIES 

Although its incident data does not clearly identify trends, the federal government 
considers arson a legitimate security and terrorist threat to its buildings and facilities in 
the United States. The use of fire as a weapon against federal property is not new. The 
Terrorism Threat Handbook (Interagency OPSEC Support Staff, 2001) reported while 
only a single arson attack against a U.S. facility and five firebombing incidents were 
reported in 1998, the following year, six arson attacks and 12 attacks that employed 
firebombs were reported. 89 

In all types of property, arson in the United States accounted for an estimated 
210,300 intentionally set fires each year from 2004 to 2006. Intentionally set fires 
account for 13% of fires responded to by U.S. fire departments. These fires resulted in an 
average of approximately 375 deaths, 1,300 injuries, and $1.06 billion in property loss 
each year (U.S. Fire Administration, 2009). In the GSA’s non-military federally owned or 
leased properties alone, from 2008 to 2010, 55 fires resulted in $10,647,586 damage. 
More than 5% of these fires were attributed to arson or domestic terrorist attack (J. 
Elvove, personal correspondence, May 10, 2011). Federal buildings, as iconic targets, are 
vulnerable to arson attacks by any number of people or organizations that may wish to 
disrupt government services or make a political or religious statement. The following 
incidents are just a few of the reported attacks on federal properties. 

• In St. Louis on April 25, 2012, a 33-year-old man was charged for 
firebombing a federal building with a 9.5 oz (281 mL) liquid filled 
glass container (KSDK, 2012) 

• Bottles similar to the one used in the St. Louis attack and sold by a 
prominent retailer were described by a New York City Bomb 
Squad technician as the “perfect containers” for a Molotov 
cocktail: 


89 The report does not define a firebomb nor differentiate between an arson or firebomb attack. The 
specific locations of these incidents were not reported. 
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They are excellent for what you need, because it is a weak-sided bottle 
with a screw-on cap,” Mr. Barry said. “It is small enough to be concealed 
in your pocket and it fits in your hand, so you can throw it almost like a 
Nerf football. It’s a small projectile you can get a good grip on and you 
can toss it. (Baker, 2012) 

• Two persons were arrested May 20, 2009 in Sacramento, 
California for leaving an incendiary device inside a paper bag next 
to the federal courthouse. (News 10/KXTV, 2009) 

• On October 4, 2010, a man set fire to the U.S. Probation Office in 
Plymouth, Massachusetts, causing an estimated $500,000 loss. 
(Harbert, 2010) 

• A non-scientific survey of national news media found anecdotal 
evidence of arson attacks on federal buildings in five states, 
attributed to suspects upset about court cases, tax burdens and drug 
indictments. (“Federal Building Fire,” 2008; Legere & Finucae, 

2010; “Sprinkler Contains Federal,” 1989; Jackson, 1990) 

• Buildings in New York’s World Trade Center complex that were 
destroyed by fire on September 11, 2001 housed a diverse group of 
federal agencies including the Secret Service, Security and 
Exchange Commission, Federal Home Loan Mortgage 
Corporation, Equal Employment Opportunity Commission, Central 
Intelligence Agency, and Internal Revenue Service. (“Building 7’s 
Exclusive,” 2007) 

The FPS is responsible for the protection of GSA owned and leased properties 
included in this study. In its 2010 analysis of 625 fire-related incidents, only a single case 
of arson was reported, and another 64 events were classified as structure fires, 
unclassified or undetermined origin (M. Harvey, personal communication, August 2, 
2011). The DHS Infrastructure Threat Analysis Branch conducted a yearlong study of 
federal and local courthouses, and detennined that while 23 reported cases of threats and 
other suspicious incidents were reported, none had a nexus to terrorism (Infrastructure 
Threat Analysis Branch, 2010). The report included two key findings applicable to this 
study. 
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• The DHS/Office of Intelligence and Analysis (I&A) has no credible or 
specific reporting indicating preoperational activity or imminent plans by 
al-Qa’ida or other terrorist or violent extremist organizations to attack 
courthouses in the United States 

• Based upon an analysis of the threats and suspicious activities . . . , the 
majority of threats likely were conveyed by individuals intending to delay, 
cancel, or harass court proceedings (2010, p. 3) 

The United States Fire Administration’s (USFA) National Fire Incident Reporting 
Systems (NFIRS) collects data from more than 22,000 local fire departments, 90 but does 
not pennit discretization from that data set of fire incident data by federal property 
ownership or tenancy. Therefore, it is impossible to detennine how many arson fires 
occurred in federally occupied or controlled buildings or facilities. Table 25 summarizes 
the most recent three-year period of arson fires for specific property uses in the general 
U.S. built environment. Table 26 provides data from the GSA. 91 


90 A fire service census conducted by the U.S. Fire Administration shows that the United States has 64 
executive branch fire departments, most of which protect wildland property through the U.S. Forest Service 
or Department of the Interior. In most cases, non-military federal buildings receive their fire protection 
services from local fire departments. See http://apps.usfa.fema.gov/census/search.cfm. 

9 * Since the NFIRS system does not permit discretization by property ownership, it is acknowledged 
that some of these events may have been reported by both the local fire services and the separate GSA 
reporting system. Furthermore, the process of voluntary data submission and processing results in a 
database is approximately one reporting year behind the current calendar. 
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Table 25. Fire Incident Data in Selected Property Types, General U.S. Built Environment, 2007-2009 (After: B. Pabody, 

personal communication, March 27, 2011) 


Year 

2007 



2008 



2009 



Summary 



Property 

type 

Total 

fires 

Arson 

fires 

% 

Total 

fires 

Arson 

fires 

% 

Total 

fires 

Arson 

fires 

% 

Total 

fires 

Total 

arson 

fires 

Arson 

% 

Total 

Office 

4,750 

247 

5.2 

4,392 

235 

5.3 

3,852 

190 

4.9 

12,994 

672 

5.17 

Courthouse 

129 

1 

0.07 

84 

2 

2.3 

85 

6 

7.0 

298 

9 

3.02 

Total 

4,879 

248 

5.08 

4,476 

237 

5.29 

3,397 

196 

5.7 

13,292 

681 

5.12 

"able 26. Fire Incident Data in Selected Property Types, GSA Properties, 2008-2010 (From: J. Elvove, personal 

communication, May 10, 2011) 

Year 

2008 



2009 



2010 



Summary 



Property 

type 

Total 

fires 

Arson 

fires 

% 

Total 

fires 

Arson 

fires 

% 

Total 

fires 

Arson , 
fires 

% 

Total 

fires 

Total 

arson 

fires 

Arson 

% 

Total 

Office 

16 

1 

6.2 

11 

1 

9.1 

14 

0 

0 

44 

2 

4.5 

Courthouse 

5 

0 

0 

1 

0 

0 

0 

0 

0 

6 

0 

0.0 

Total 3 

21 

1 

4.8 

12 

1 

8.3 

14 

0 

0 

50 

2 

4.0 


a Retail and mobile property types have been deleted from the entire GSA data set in this comparison. 
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Depending upon the data source, the fire and arson data picture among GSA 
properties is not entirely clear. In comparison to the GSA data, the DBT cites FBI 
Uniform Crime Reporting data and DHS’ FPS records that indicate that from 2007 
through 2010, nine arson cases were reported among approximately 9,000 GSA 
properties. 

According to Baird (2006), “historical analysis of incidents coupled with open 
source information reveals that terrorist groups in general are adapting toward simple 
destructive methods like arson with increasingly high levels of fatalities” (p. 416). 
Bjelopera and Randol (2010) found that 19 of 43 homegrown jihadist terrorist plots 
targeting the United States since September 11, 2001 were involved in whole or in part 
with explosives or incendiary devices. They concluded: 

Historically, most terrorist incidents in the United States have involved 
bombs or fires. According to research drawn from the National 
Consortium for the Study of Terrorism and Responses to Terrorism’s 
Global Terrorism Database, about 83% of all terrorist incidents on U.S. 
soil between 1970 and 2007—including violent jihadists as well as non- 
jihadists—have included explosives or incendiary devices, (p. 27) 

In contrast, Center for Homeland Defense and Security professor and RAND 
Institute analyst Dr. Seth Jones offered a qualified assessment that the al Qaeda threat is 
overstated. 

I have reviewed much of the U.S. government analysis of al Qa’ida 
leaders, including the interrogations of key leaders (Khalid Sheikh 
Mohammad, Abu Zubaydah, Abd al-Hadi al-Iraqi, etc.)—and can’t 
remember ever seeing this come up. Many other things do, including 
attacks against subways, trains, airplanes, etc. Pyroterrorism is, of course, 
a problem—as is arson more broadly, (personal communication, May 9, 

2011) 

In its analysis of the arson threat on federal properties, the DBT emphasizes threats from 
domestic terrorist groups focused on environmental issues: the Animal Liberation Front 
(ALF) and the Earth Liberation Front (ELF), both of which commonly use fire as their 
preferred weapon of disruption and destruction (Deshpande, 2009). 
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The potential for eco-terrorists and other like-minded extremists to use 
arson as an attack method, to include IIDs (Improvised Incendiary 
Devices), makes it likely that this type of attack will continue in the future. 

The frequency of attacks may increase commensurate with the frequency 
of Federal properties expanding into wilderness areas. (U.S. Department 
of Homeland Security, 2010a; U.S. Department of Homeland Security, 

2010a, p. 7.2.4) 

Similarly, a controversial DHS intelligence assessment on domestic rightwing 
extremism concluded that economic and political conditions existed in 2009 similar to the 
1990s, when the number of domestic rightwing terrorist and extremist groups rose, with a 
corresponding increase in violent attacks targeting government facilities, law 
enforcement officers, banks, and infrastructure sectors (Extremism and Radicalization 
Branch, Homeland Environment Threat Analysis Division, 2009). The intelligence 
assessment did not speculate on the manifestation or frequency of attacks that might be 
conducted by these groups. 

B. IMPROVISED INCENDIARY DEVICES (IID) 

Substantial research exists on IED, especially in the war zones of Afghanistan and 
Iraq, and as a technique, their use in terrorist attacks on military and civilian populations 
in densely populated urban areas. While the destructive forces of IED often are the 
primary concern of federal security professionals trying to protect assets from a terrorist 
attack, a direct chemical and physical link exists between IED and IID. In fact, many 
descriptions of IED include references that they contain incendiary or pyrotechnic 
constituents (Finegan, 2006; Bush, 2007; Wilkinson, Bevan, & Biddle, 2008). The 
instantaneous oxidation that occurs when an IED explodes is the same chemical reaction 
that occurs in a fire; only the speed with which the chemical reaction and the ensuing 
shock wave occur are different. 92 


92 Explosions often are characterized as “detonations” in which the shock wave exceeds the speed of 
sound (approximately 786 miles per hour in dry air at 68°F [335 m/s at 20°C]). Sub-sonic shock waves— 
typically resulting from ignition of volatile flammable liquid vapors—are known as “deflagrations.” 
Variables, such as relative ambient humidity or the proportion of volatiles to air, can affect these values 
(Zalosh, 2003). 
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Furthermore, the instantaneous oxidation of an IED may be the trigger for a 
secondary, fire bomb-type device. The car bomb parked May 2, 2010 in New York City’s 
Times Square by Faisal Shahzad contained 10 gallons of gasoline and three 25-pound 
liquefied petroleum gas cylinders (“Faisal Shahzad Sentenced,” 2010). As Sweetow 
(2009) reported, “while many people incorrectly refer to the 9/11 attacks in the colloquial 
as ‘bombings,’ they were actually incendiary attacks combining the kinetic energy of fast 
moving jets with tens of thousands of gallons of jet fuel, to devastating effect” (p. 33). 
Schubert (2008) contended that flammable fuels—when finely atomized by an accident 
or primary explosion—can produce pressure waves that result in severe proximal 
destruction. 

Improvised incendiary devices exist in a variety of fonns and sizes ranging from 
handheld containers with simple cloth or paper wicks (famously known as Molotov 
cocktails) to transportation apparatus and systems that carry a variety of flammable 
liquids and gases that could be ignited for nefarious purposes. The Internet provides easy 
access to improvised incendiary device-making instructions in written and video fonnats 
(“How to Build an Incendiary Bomb,” 2007; Helmenstine, 2011; Dilegge, 2010; How to 
Make a Bomb,” 2011; “How to Make a Fire Bomb,” 2009; “Homemade Explosives, 
Pyrotechnics, Rockets and More!” 2011). While the simplicity of manufacturing and 
deploying handheld IID makes them a convenient and realistic threat (Romboy & Penrod, 
2011; Dize, 2011; Oreg, n.d.; “Man Arrested in Marina del Rey,” 2011), attacks on large 
road, rail, air, and marine transportation vessels carrying flammable and other hazardous 
cargoes are also a concern (Peterman, Elias, and Fritelli, 2011; Jenkins et ah, 2010; 
Wheeler, 2006). The natural gas pipeline explosion in San Bruno, California—although 
not the result of a terrorist attack or criminal enterprise—showed that even the fixed 
transportation networks of hazardous materials could be exploited to create significant 
fires (U.S. Transportation Security Administration, 2011; Lagos, Fagan, Cabanatuan, & 
Berton, 2010). The products that fuel U.S. commerce also leave this nation susceptible to 
improvised incendiary attack. 
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The use of IID is an increasing concern among homeland security officials, 
particularly since the scale and scope of the threat is not well articulated. For his Center 
for Homeland Defenses and Security thesis, Raynis (2006) explored the terrorist use of 
IID and found that “the homeland security community’s intense concentration on the 
threat posed by IEDs has caused it to overlook the use of IIDs as potentially devastating 
terrorist weapons. Such a preparedness oversight has created the kind of weakness that 
terrorists prey on” [sic] (p. 43). Additionally, Raynis (2006) described the simplicity with 
which IID can be created and deployed. 

Incendiary devices are easily improvised and are inexpensive to produce. 

The materials to construct an IID are readily available from any hardware 
or grocery store, and are unlikely to invite suspicion from store 
employees. There are many advantages to using IIDs as terrorist weapons: 
they require little training to prepare and use. Overall, flammable materials 
are not as volatile as explosives; a person using these materials therefore 
does not require the same level of knowledge and experience as someone 
handling explosives, (p. 36) 

The Transportation Security Administration (TSA) (U.S. Transportation Security 
Administration, 2008) stated that international terror organizations, affiliated individuals 
and like-minded or inspired persons, had declared their intent to employ IID against 
targets in the United States. According to the report, “firebombing, a simple and common 
tactic among domestic terrorists and criminals, could produce mass casualties and 
destruction, and create intense fear and anxiety in the public. IIDs are generally 
improvised more easily and are less expensive the improvised explosive devices” (p. 3). 
Finegan (2006) drew an even more ominous conclusion, “ignoring emerging threats 
won’t make them go away. If public safety officials apply lessons learned from threat 
assessment and recognize that our enemies are reacting to our actions, they will quickly 
realize that ignoring emerging threats will only embolden our enemies and make these 
types of attacks more likely” (p. 109). 
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TSA’s analysis found that incendiary devices constructed and deployed with 
strategic placement can cause damage even greater than a similar sized explosive device, 
because “the fuel may cause a rapidly growing fire that is difficult for first responders to 
contain, causing an ever-increasing amount of property damage over time” (U.S. 
Transportation Security Administration, 2008, p. 5). 

C. ACCELERANTS 

The DBT mentions that the IID presumed to be used in the arson scenario 
contains an accelerant, but like the remainder of the scenario, does not describe it in 
adequate detail to enable appropriate countermeasures to be developed. In the scenario, 
the accelerant is the first item ignited and the predominant source of fuel anticipated to 
threaten the facility. While a scientific consensus for a definition of an accelerant does 
not exist, the NFPA 921 Guide for Fire and Explosion Investigations defines an 
accelerant as “a fuel or oxidizer, often an ignitible [sic] liquid, used to initiate a fire or 
increase the rate of growth or spread of fire” (National Fire Protection Association, 
2011). According to Babrauskas (2003), accelerants used in incendiary fires are most 
commonly detennined by forensic analysis to be a hydrocarbon-based liquid, such as 
gasoline, kerosene, paint thinners, solvents, and similar products. In one five-year study, 
he cited these products were identified as accelerants in 86.9% of debris samples testing 
positive for accelerants. 

Forensic analysis of fire debris for the presence of accelerants usually is 
performed under laboratory-controlled conditions using gas chromatography-mass 
spectrometry, a process that enables the laboratory technician to identify a generic 
product based on its chemical composition or signature. ASTM International, a world- 
renowned standards development organization, recognizes five test protocols for 
identifying ignitable liquid residues in fire debris. Once identified, these products may be 
classified into one of nine major product categories, each 93 having three “weight” 


93 Except that the gasoline category includes gasohol (Stauffer & Lentini, 2003). 
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subcategories (light, medium, and heavy) based on the number of carbon atoms 94 in their 
molecular chain. Table 27 summarizes the ASTM International ignitable liquid 
classification system, and provides generic examples of some common products (Stauffer 
& Lentini, 2003). Most of these products, in one fonn or another, are available without 
restriction on the open market in wholesale or retail environments; thus, they are easily 
accessible to both legitimate users and potential criminals. 


Table 27. ASTM International Ignitable Liquid Classification System with Examples 

(After: Stauffer & Lentini, 2003) 


Class 

Light 

C4 to C9 

Medium 3 

Cs to C13 

Heavy 

Cs to C 20 

Gasoline/Gasohol 

Fresh gasoline typically falls in the range of C 4 -C 12 


Petroleum 

distillates 

Petroleum ether, 
some cigarette light 
fluids, some 
camping fuels 

Some charcoal 
starters, some paint 
thinners, some dry 
cleaning solvents 

Kerosene, diesel 
fuel, some jet fuels, 
some charcoal 
starters 

Isoparaffinic 

products 

Aviation gas, 
specialty solvents 

Some charcoal 
starters, some paint 
thinners, some 
copier toners 

Some commercial 
specialty solvents 

Aromatic products 

Some paint and 
varnish removers, 
some automotive 
parts cleaners, 
xylenes, toluene- 
based products 

Some automotive 
parts cleaners, some 
specialty cleaning 
solvents, some 
insecticide vehicles, 
fuel additives 

Some insecticide 
vehicles, some 
industrial cleaning 
solvents 

Naphthenic 
paraffinic products 

Cyclohexane based 
solvents/products 

Some charcoal 
starters, some 
insecticide vehicles, 
some lamp oils 

Some insecticide 
vehicles, some lamp 
oils, industrial 
solvents 

/j-Alkanes 

products 

Solvents, pentane, 
hexane, heptane 

Some candle oils, 
copier toners 

Some candle oils, 
carbonless forms, 
copier toners 

De-aromatized 

distillates 

Some camping fuels 

Some charcoal 
starters, some paint 
thinners, 

Some charcoal 
starters, odorless 
kerosene 


94 Represented in Table 27 as C n . 
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Class 

Light 

C4 to C9 

Medium 3 

Cg to C13 

Heavy 

Cs to C 20 

Oxygenated 

solvents 

Alcohols, ketones, 
some lacquer 
thinners, fuel 
additives, surface 
preparation solvents 

Some lacquer 
thinners, some 
industrial solvents, 
metal cleaners/gloss 
removers 


Others- 

miscellaneous 

Single component 
products, some 
blended products, 
some enamel 
reducers 

Turpentine products, 
some blended 
products, various 
specialty products 

Some blended 
products, some 
specialty products 


d ASTM E 1618-01 “Standard Test Method for Ignitable Liquid Residues in Extracts from Fire Debris 
Samples by Gas Chromatography-Mass Spectrometry,” ©2002 permits variations if the carbon number 
does not fit neatly into a category (Stauffer & Lentini, 2003, p. 65). 


The U.S. Department of Justice, Bureau of Alcohol, Tobacco, Firearms and 
Explosives (BATFE) is authorized under the 1982 Anti-Arson Act 95 to investigate 
explosions and fires if federal interest in the event is present. BATFE may support state 
or local jurisdictions in investigations depending upon the nature of the target, victims, 
property damage death, or injuries (U.S. Department of Justice, 2006). Physical evidence 
collected by BATFE agents is submitted to its Laboratory Services Division for forensic 
analysis. From 2000 to 2009, the Laboratory Services Division analyzed 4,485 fire debris 
samples, and identified residues of ignitable liquids in 2,328 exhibits (A. Blank & R. 
Kuk, personal correspondence, August 3, 2011). Table 28 provides the distribution 
frequency of liquids by ASTM classification for the samples analyzed. In nearly two- 
thirds of the examples, gasoline/gasohol products were found in the fire debris, which 
clearly makes it the product of choice by adversaries intent on performing criminal acts 
using accelerants. 


95 See 18U.S.C. §841. 
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Table 28. Distribution Frequency of Ignitable Liquids in Federal Arson Debris 
Analysis, 2000-2009 (After: R. Kuk, personal communication, April 11, 

2011) 


Class 

Positive Results 
(N= 2,328) 

Percentage 

Gasoline/Gasohol 

1,455 

62.50 

Petroleum distillates: 

— 

— 

Light (C 4 to C 9 ) 

91 

3.91 

Medium (Cg to Cn) 

263 

11.30 

Heavy (C 8 to C 20 ) 

345 

14.82 

Isoparaffmic products 

34 

1.46 

Aromatic products 

130 

5.58 

Naphthenic paraffinic products 

24 

1.03 

//-Alkanes products 

56 

2.41 

De-aromatized distillates 

— 

- 

Oxygenated solvents 

123 

5.28 

Others-miscellaneous 

42 

1.80 


The ignitable liquid data obtained from the BATFE laboratory comport with 
Babrauskas’s 2003 findings that hydrocarbon-based liquids, such as gasoline, kerosene, 
paint thinners, solvents, and similar products, are the most commonly used accelerants. 
The findings seem logical since these products are easily available to consumers in retail 
outlets at which their purchase would not raise undue suspicion. 

In a 10-year study of incendiary devices used or recovered in arson cases 
investigated in the United States by the BAFTE, the U.S. Bomb Data Center collected 
data on 1,915 IID incidents. Of those events, IID components, such as containers, igniters 
or main charges, were recovered for processing in 38.3% of the cases (n=735) and 
containers were recovered in 34.6% (n=662) more cases. Of 517 containers with a 
reported volume, 77% were less than 64 oz (1,900 mL) in size with the majority being 
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consumer beer or soda bottles of 40 oz (1,180 mL) of less (J. Oliver, personal 
communication, August 29, 2011). Table 29 provides a breakdown of the container 
volumes analyzed. 
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Table 29. Recovered IID Container Volumes (After: R. Kuk, personal communication, April 11, 2011) 


Container 
Volume (oz) 

Container 
Volume (mL) 

Number of 
containers 

% of Total Sample 
(n=662) 

% of Known 
Container Size (n=517) 

64 or less 

1900 or less 

400 

60.4 

77.4 

Not reported 

Not reported 

145 

21.9 

NA a 

More than 64 

More than 1900 

117 

17.7 

22.6 

Total 


662 

100% 

100% 


d NA= Not applicable. 


151 



The arson scenario in the ISC DBT describes a threat event where an adversary 
places an unidentified and non-quantified IID containing an accelerant and utilizing a 
delay mechanism adjacent to a facility. The data provided by Babrauskas and BATFE 
suggest the most likely accelerant used in this scenario would be gasoline or another of 
the commonly available light, medium, or heavy petroleum distillates. However, the 
quantity and condition remain undescribed; is it a handheld 25 oz. (750 mL) glass bottle 
that has been broken and spills its contents (e.g., a Molotov cocktail) or is it a large 
gasoline tanker truck with a capacity ranging from 5,500 to 9,000 U.S. gallons (21,000 to 
34,000 L) that is ignited by an incendiary projectile? This information can be significant 
when conducting fire model analysis of a design scenario, because in addition to the 
latent heat of combustion of the specific product, the amount and how it is dispersed 
affects a fire’s HRR. According to Babrauskas and Peacock (1992), the HRR is the most 
important variable in predicting fire behavior in a compartment. Table 30 provides data 
from the BATFE Laboratory Services Division that compares the HRR at four time 
points following ignition (30, 60, 90, and 120 seconds) for different amounts and 
distributions over different areas for some gasoline, kerosene, and heptane samples. 

Tests were performed on different volumes of ignitable liquids in open-top 
vessels of differing size. The liquid depth in the test apparatus was not specified. For 
illustration, all quantities in the tests exceeded 50.8 oz. (1,500 mL), roughly equivalent to 
two standard bottles or one magnum of wine found in retail markets. The data are useful 
to show the differences in HRR for a variety of volumes and configurations; not all 
burning accelerants emit energy at the same rate. The ISC DBT should consider these 
variables in its scenario criteria. Of note is that for the configurations tested, 75% reached 
their peak HRR between 60 and 90 seconds following ignition before tending toward 
extinction, suggesting that—barring ignition of other objects—protective 
countermeasures should be employed that will intervene early in the fire, such as 
automatic fire suppression systems. 
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Table 30. Heat Release Rates over Time for Varying Hydrocarbon Quantities and Surface Areas (After: R. Kuk, personal 

communication, April 11, 2011) 


Product 

Gasoline 

Gasoline 

Gasoline 

Gasoline 

Gasoline 

Kerosene 

Kerosene 

Heptane 

Product volume 

51.5 

64.2 

103.1 

255.9 

206.1 

51.5 

103.1 

64.24 

(oz.) 









(niL) 

1,524 

1,900 

3,048 

7,570.8 

6,096 

1,525 

3,048 

1,900 

Test size 

113.1 

254.5 

452.3 

452.3 

1809.5 

113.1 

452.3 

254.5 

(sq. in.) a 









(cm 2 ) 

729.7 

1,641.9 

2,918.1 

2,918.1 

11,674.1 

729.7 

2,918.1 

1,641.9 

Time from ignition (sec.) 




Heat Release Rate in kW 




30 

70.81 

89.39 

281.97 

307.51 

1,714.11 

34.12 

19.46 

100.46 

60 

67.52 

112.04 

387.00 

422.49 

1,832.02 

45.28 

197.55 

155.81 

90 

72.24 

131.62 

365.77 

526.82 

1,418.55 

53.62 

281.95 

190.02 

120 

70.44 

132.14 

370.63 

517.02 

571.02 

52.55 

308.32 

154.26 


J The product depth in the test apparatus was not specified. 
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These BATFE tests were conducted in controlled laboratory conditions. The application 
of the test results in the built environment in which varying conditions exist for ground or 
floor surfaces, air movement, humidity, temperature, building construction, and other 
environmental factors that affect fire behavior should be subject to additional study. 

D. SUMMARY 

Fire’s use as a weapon predates man’s recorded history, and remains a destructive 
force when an adversary uses it to attack persons or property. DHS’ ISC assesses the 
arson threat against federal property to be high, given the unsophisticated nature of the 
attack method, the historical frequency of its use in general, and specifically, against 
federal facilities, the availability of specific information on planning, and the ease of 
executing an attack. However, data variances among the agencies responsible for 
collecting fire incident information (GSA, FBI, FPS, and USFA) in federal properties do 
not support the argument that recent historical frequency of arson against federal 
properties is statistically significant. No doubt exists that detennined adversaries may 
adapt their terrorist or criminal tactics to include fire (Rasmussen & Hafez, 2010; 
Balachandran, 2011; Dolnik, 2007); however, the threat is not well articulated, which 
makes it impossible to design effective countermeasures. 

In those events in which accelerants are used to increase the rate of fire spread or 
growth, the preferred materials appear to be commonly obtainable retail products, such as 
gasoline, kerosene, or solvents. The type, volume, and dispersion effects of the 
accelerants can affect the outcome of a fire, and should be given thorough consideration 
in the design of active or passive countenneasures. 
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VII. METHOD, DATA AND FINDINGS 


The development of federal administrative regulations is a complex process 
involving many—and sometimes competing—interests. The creation of the Physical 
Security Criteria for Federal Facilities standard was the work of participants from more 
than 20 agencies representing law enforcement, building construction and management, 
security, diplomacy, intelligence, education, human health, finance, and environmental 
protection. Given the range of professional disciplines involved, traditional quantitative 
or qualitative research methods alone may not fully address the breadth, complexity, and 
synergy of this effort. To get a more complete picture to perform better policy analysis, a 
variety of research methods is desirable. 

The mixed method approach was selected to dissect and evaluate the existing 
policies (the Physical Security Criteria for Federal Facilities standard and its supporting 
DBT 96 ) with the intent of identifying potential shortcomings and improvements. Four 
research methods were used to build a framework to assess the existing policy 
documents: 1) an appraisal of GSA, FPS, and national fire and arson incident data, 2) a 
thematic content analysis of the existing literature pertinent to arson and performance 
based design practices, 3) a Delphi survey method to fonnulate a baseline arson scenario, 
and, 4) the creation of two virtual prototypical federal buildings, then subjecting both 
designs to simulated fires using state-of-the-art fire effects modeling. A planned fifth 
method, an online survey of licensed professional architects to obtain design insights, 
returned so little data as to be worthless. 97 

A. NATIONAL FIRE AND ARSON INCIDENT DATA 

Good policy is built on a foundation of solid data. The purpose of reviewing fire 
and arson infonnation from national incident databases was to obtain a measure of the 

99 The DBT is a separate ISC document that outlines 31 potential threat scenarios against which 
permanent countermeasures ostensibly can be designed, constructed, and evaluated. 

97 A survey of 118 licensed architectural firms known to the student researcher returned only 10 
responses for a response rate of 8.47%, and only seven respondents (5.9%) completed the entire survey. 
Further research among this target audience was abandoned after a six-week open survey period. 
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number and characteristics of events that occur in the types of buildings normally owned, 
occupied, or used by the federal government, and that may be subject to the Physical 
Security Criteria for Federal Facilities standard. Unfortunately, the ability to obtain 
unconditional data applicable specifically to federal properties is limited by the nature of 
the publicly available data sources, as well as the inconsistencies among the sources. 

Local fire departments and fire marshal’s offices are a common source of fire 
incident data. Due to the longstanding decentralized nature of fire services in the United 
States, until the 1970s, no comprehensive national database of fire and arson incidents 
existed. Each fire agency created and maintained its own records management system; no 
urgent need existed to share data among other organizations. This landscape changed 
somewhat in 1974 with the adoption of the National Fire Prevention and Control Act 
(Public Law 93-498) that established a National Fire Data Center (NFDC) to collect and 
analyze national fire and arson incident data (Ahrens, Stewart, & Cooke, 2003). The 
USFA is home to the NFDC’s NFIRS, a voluntary data collection and assessment system. 
The NFIRS has two objectives, to help state and local governments develop fire reporting 
and analysis capability for their own use, and to obtain data that can be used to assess 
more accurately, and subsequently, combat the fire problem at a national level (U.S. Fire 
Administration, 2010a). NFIRS collects details about individual incidents to evaluate 
such factors as fire cause, structure type (e.g., dwelling, school, factory, or office), 
building construction, nature of the occupants, ignition source, first item ignited, smoke 
and fire spread, extent of damage, and performance of fire protection systems. This data 
gives researchers a rich source of infonnation to mine for both trends and anomalies. 

Approximately 22,000 of the nation’s estimated 27,166 fire departments (U.S. 
Fire Administration, 2006) report each year through a bottom-up system in which their 
local fire incident data is sent to a central collection point within their state. The state’s 
combined data is scanned for errors and corrected, and the 50 state agencies and the 
District of Columbia submit their collated reports to the USFA’s NFIRS national 
database. Due to the time it takes to collect and process the data from the various sources, 
the most recent data available is from calendar year 2009. 
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Similarly, local or state law enforcement agencies that may have investigatory 
responsibilities may voluntarily submit their arson data to the FBI through Uniform 
Crime Reports (UCR). Data can be submitted in summary form for the so-called Index 
Crimes, 98 or in detailed form in the National Incident-Based Reporting System (NIBRS). 
Approximately 6,400 law enforcement agencies participate in NIBRS and 17,000 
agencies contribute Index Crime data to the FBI; however, because of computer 
problems, changes in records management systems, personnel shortages, or a number of 
other reasons, some agencies cannot provide data for publication (B. Pabody, personal 
communication, March 27, 2011). According to B. Pabody (personal communication, 
May 1, 2011), no correlative effort exists between the NFDC and UCR data sets; 
therefore, in some instances, data may be duplicative. Thus, it is unimaginable to have 
other than a generic statistical picture of the nation’s arson problem. 

Another potential data source, the non-profit NFPA, collects data by sampling 
methods that reached 2,790 fire service organizations in 2010 (Karter, 2012). It then uses 
statistical methods to estimate the overall number of fires that occur in the United States. 
As a matter of practice, NFPA does not analyze individual data submitted by fire 
agencies. 

Given the data fields collected in NFIRS, UCR or NIBRS, it is impossible to 
extract ownership information to identify discrete, federally owned, or occupied 
properties. Part of the difficulty occurs because federal buildings may be co-located with 
privately owned real property, or federal agencies may occupy leased space. In its most 
recent inventory of non-military real property assets, the federal government reported it 
owned or leased 3.34 billion square feet (3.1029 x 10 7 m 2 ) in 429,000 buildings (Federal 
Real Property Council, 2009; U.S. General Services Administration, 2010b). To get a 
sense of the scale of those combined holdings, 3.34 billion square feet is more than 
60,727 times the size of The White House, perhaps the most iconic of all federal 
buildings. Having the ability to identify federally owned or occupied properties in the 


98 UCR Index Crimes include murder and non-negligent manslaughter, forcible rape, robbery, 
aggravated assault, burglary, larceny-theft, motor vehicle theft, and arson. NIBRS collects incident data on 
33 types of offenses. 
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entire NFIRS or NIBRS databases would enhance the analytical value of this study, but 
absent the specific information, generalizations about fire and arson incidents must be 
interpolated from the general population’s data, as well as infonnation provided by the 
GSA and the FPS. 

Unfortunately, data provided by the GSA and the FPS was incomplete and 
inconsistent. According to J. Elvove (personal communication, May 10, 2011), the GSA 
does not participate in the NFIRS because the fire service and local government-oriented 
data NFIRS produces is not entirely applicable to the GSA’s property management needs. 
Furthermore, the GSA does not have clear policies in place that specify when or by 
whom fire incidents in their properties must be reported. Generally, if estimated property 
damage from a fire is less than $50,000, no report is required. In some cases, according to 
Elvove, events may be reported by contractors who may have been responsible for the 
incident (such as electrical fires or fires caused by careless hot-work roofing practices), 
but no incentive exists for contractors to provide that information candidly. The GSA’s 
data is current from calendar year 2010. The FPS fire incident data (calendar year 2010) 
is statistically more detailed—including counts for fires, false fire alarms, fire protection 
system malfunctions, and unclassified events—but provides little substantive infonnation 
to enable a comprehensive analysis. 

1. Fire Incident and Arson Data 

Table 31 provides data comparing fires in federal and non-federal offices and 
courthouses for the period from 2007 to 2010. Table 32 provides data comparing arson 
incidents in federal and non-federal offices and courthouses for the period from 2007 to 
2010. Since the data ranges collected from these sources (NFIRS, GSA and FPS) is 
available for only two concurrent years (2008-2009), the ability to perfonn long-tenn 
analysis is limited and the data provides only a general picture of the fire and arson 
problem in federal properties. 
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Table 31. Fire Incident Data in Federal/Non-Federal Offices/Courthouses, 2007-2010 (From: Federal property data from J. 

Elvove, personal communication. May 10, 2011 and M. Harney, personal communication, Federal Protective 
Service, 2011. All other data from USFA National Fire Data Center, personal communication, March 27, 2011) 


Year 

Property type 

2010 

2009 

2008 

2007 

Total 

Federal offices 

14 

14 

16 

NR a 

44 

All other offices 

NR 

3,852 

4,392 

4,750 

12,994 

Federal courthouses 

0 

1 

5 

NR 

6 

All other courthouses 

NR 

85 

84 

129 

298 

Total 

14 

3,952 

4,497 

4,879 

13,342 


a NR = Not reported. 


Table 32. Arson Incident Data in Federal/Non-Federal Offices/Courthouses, 2007-2010 (From: Federal property data from J. 

Elvove, personal communication, May 10, 2011 and M. Hamey, personal communication, Federal Protective 
Service, 2011. All other data from USFA National Fire Data Center, personal communication, March 27, 2011) 


Year 

Property type 

2010 

2009 

2008 

2007 

Total 

Federal offices 

1 

1 

1 

NR a 

3 

All other offices 

NR 

190 

235 

247 

672 

Federal courthouses 

0 

1 

1 

NR 

2 

All other courthouses 

NR 

1 

2 

6 

9 

Total 

1 

193 

239 

253 

686 


'NR = Not reported. 
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However, other data from these sources does help answer one of the secondary 
research questions of this thesis: “Should the Interagency Security Committee reports 
Physical Security Criteria for Federal Facilities and the DBT be limited to criminal or 
“man made” threats as stated in the documents?” Both documents state “other threats to 
buildings, such as earthquakes, fire, or storms are beyond the scope of this document and 
are addressed in applicable construction [and life safety] 99 standards . . (U.S. 

Department of Homeland Security, 2010a; U.S. Department of Homeland Security, 
2010b). According to data presented in Table 2, Ignition Sources for Fires in GSA 
Federal Facilities 2008-2010, 94.6% of the fires were caused by sources other than 
manmade, including cooking, electrical, welding or cutting, and other or unclassified. 

Federal construction standards—discussed in Chapter VI—since 1988 have 
mandated compliance with model building and fire codes, and since 1996, have included 
additional specifications for fire protection and life safety in the form of the “Facilities 
Standards for the Public Building Service (PI00).” The primary goal for the Pi00 
standard is to create conditions that protect occupants and visitors, while the secondary 
goals are to reduce the federal government and taxpayers’ potential losses from fire by 
protecting real property, maintaining mission continuity, and protecting the environment 
(Pi00 standard, p. 235). From 2008 through 2010, only two fire-related fatalities have 
been reported in federally owned or managed properties, both of which occurred 
February 18, 2010 when a small aircraft was flown into a building containing an Internal 
Revenue Service office in Austin, Texas (Brick, 2010). This incident also was 
responsible for 13 injuries (KVUE and The Associated Press, 2011). Table 33 shows the 
distribution of fire deaths and injuries in federal and non-federal offices and courthouses 
for the period 2007 through 2010. 


99 The DBT adds “and life safety” to the text. 
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Table 33. Fire Deaths and Injuries in Specific Properties, 2007-2010 (From: Federal property data from J. Elvove, personal 
communication. May 10, 2011 and M. Hamey, personal communication, Federal Protective Service, 2011. All 
other data from USFA National Fire Data Center, personal communication, March 27, 2011) 


Year 

2010 


2009 



2008 

2007 


Total 

Property 

type 

Deaths 

Injuries 

Deaths 

Injuries 

Deaths Injuries 

Deaths 

Injuries 

Deaths 

Injuries 

Federal 

offices 

2 

14 

0 

2 

0 

3 

NR a 

NR 

2 

17 

All other 
offices 

NR 

NR 

0 

14 

3 

34 

7 

29 

10 

77 

Federal 

courthouses 

0 

0 

0 

0 

0 

0 

NR 

NR 

0 

0 

All other 
courthouses 

NR 

NR 

0 

1 

0 

0 

0 

6 

0 

7 

Total 

2 

14 

0 

17 

3 

37 

7 

35 

12 

101 


a NR = Not reported. 
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The secondary goal, reducing property loss and maintaining continuity of 
operations, is more difficult to quantify and is open to vagaries in subjective analysis. 
Historically, property fire losses are reported in dollar values of direct and indirect loss, 
but are not very reliable indicators of the scale of an event. A single room fire that 
destroys an irreplaceable computer system may cause more direct and indirect monetary 
damage than an entire warehouse full of printed government forms. Direct loss is the 
measure of property physically damaged or destroyed during the fire and fire control 
efforts. However, indirect loss includes intangibles, such as lost business opportunities 
and lost customers in the private sector, and interruptions to operations or services in the 
public sector. “Indirect loss could also include dollar equivalents for environmental 
damage or damage to cultural heritage, but there is no good data source available on these 
types of indirect damage” (Hall, 2010a). Likewise, according to Ahrens, Frazier, and 
Heeschan (2003), dollar estimates of property damage are skewed because they involve 
guesswork or are never reported to the fire department, especially in the case when 
affected property owners are able to handle the event with on-site resources. To illustrate 
the wide variety of estimates, Table 34 shows the total reported direct fire loss (not 
adjusted for inflation) in federal offices and courthouses and non-federal offices and 
courthouses. 
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Table 34. Estimated Direct Property Loss Federal/Non-Federal Offices and Courthouses, 2007-2010 (From: Federal 

property data from J. Elvove, personal communication, May 10, 2011 and M. Hamey, personal communication, 
Federal Protective Service, 2011. All other data from USFA National Fire Data Center, personal communication, 

March 27, 2011) 


Year 

Property type 

2010 

2009 

2008 

2007 

Total 

Federal offices and 
courthouses 

$3,453,291 

$231,000 

$6,963,295 

NR a 

$10,647,586 

All other offices 
and courthouses 

NR 

$65,675,084 

$79,742,780 

$57,858,791 

$204,276,665 

Total 

$3,453,291 

$65,906,084 

$86,706,075 

$57,858,791 

$214,924,251 


a NR = Not reported. 
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A less subjective measure, and one that addresses the continuity of operations 
priorities of the federal government, is the number of incidents when the fire was 
confined to the room or object of origin. This measure indicates the fire may have self- 
extinguished before spreading to other objects, was suppressed in the early stages by 
human intervention, or an automatic fire suppression system, or the nature of the passive 
fire protection features (e.g., firewalls, doors, and other compartmenting features) 
confined the fire and limited its effects. By confining the fire to the object or room of 
origin, less collateral damage occurs and a greater likelihood exists that operations can 
return to normal more quickly once the damage has been repaired. Table 35 identifies the 
number of fires in federal and non-federal properties when the incident was confined to 
the object or room of origin. 

Table 35. Fire Incidents where Fire Confined to Object or Room of Origin, 2007-2010 
(From: Federal property from J. Elvove, personal communication, May 10, 
2011. All other data from USFA National Fire Data Center, personal 

communication, 2011) 


Year 

Property type 

2010 

2009 

2008 

2007 

Total 

Federal offices 

11 

13 

15 

NR a 

39 

All other offices 

NR 

623 

928 

888 

2,439 

Federal courthouses 

0 

1 

1 

NR 

2 

All other courthouses 

NR 

18 

19 

13 

24 

Total 


644 

959 

897 

2,510 


a NR = Not reported. 


When looking at these numbers as a percentage to total events (see Table 36), it is 
apparent that the outcome of fires in federal offices and courthouses is superior to that of 
non-federal properties. Fires that occur in federal buildings are more than four times more 
likely to be confined to the object or room of origin than in non-federal properties. 
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Table 36. Percentage of Incidents Where Fire Confined to Object or Room of Origin, 
2007-2010 (From: Federal property from J. Elvove, personal 
communication, May 10, 2011. All other data from USFA National Fire Data 
Center, personal communication, 2011) 


Year 

Property type 

2010 

2009 

2008 

2007 

Median 

Federal offices 

71.5 

92.8 

93.7 

NR a 

86.4 

All other offices 

NR 

16.2 

21.1 

18.7 

18.8 

Federal courthouses 

0 

100.0 

20.0 

NR 

33.3 

All other courthouses 

NR 

21.4 

22.4 

2.3 

8.1 


a NR = Not reported. 


Additional research is warranted to explain this disparity over what factors are 
influencing the outcomes 100 between federal and non-federal properties, but given the 
comparative success of containing fires to the object or room of origin in conjunction 
with the preponderance of accidental ignition sources in federal buildings, 101 it appears 
the “applicable construction [and life safety] standards” cited in the Physical Security 
Criteria for Federal Facilities and the DBT are adequate to satisfy the primary goal of 
life safety and the secondary goals of property protection and environmental controls. 

B. THEMATIC CONTENT ANALYSIS OF THE RECENT LITERATURE 

Boote and Beile (2005) emphasized the importance of the literature review as a 
research method because it advances collective understanding about the particular topic 
being studied, and to enhance that collective understanding an analysis of what has been 
written previously is required. The literature review is the foundation of any research 
project to frame its context, clearly demarcates what is and what is not within the scope 
of study, and justifies the reasons for the structure (Boote & Beile, 2005). In addition, 


100 Among others, factors could include the existence of automatic fire detection and suppression 
systems, fire resistive construction with automatic opening protectives (e.g., fire doors and dampers), 
aggressive enforcement of safety rules and regulations, employee continuing training and education, or a 
cultural commitment to maintaining a safe working environment. 

101 Only 5.4% of fire incidents were classified as malicious. 
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Leedy and Ormrod (2010) reported that a review of the literature on a particular topic is 
helpful as its own analytical tool to interpret the results of an individuals’ study and relate 
them to what is already known about the matter being researched. 

The purpose of conducting a literature review for this study was to assess whether 
the perfonnance-based design methods could be employed as effective arson 
countenneasures, and whether the design criteria published by the SFPE and ICC might 
be transferable to the Physical Security Criteria for Federal Facilities standard to answer 
the primary and secondary research questions. 

A thematic, open-ended content analysis approach was used to assess the current 
perspective of the literature on performance-based design and its application to arson or 
incendiary scenarios. A non-probabilistic sample (N = 150) of professional journals and 
other sources pertinent to building construction was selected, and keyword searches were 
conducted on one or more combinations of the following terms: building construction, 
building codes, performance-based design, perfonnance-based codes, fire safety, arson, 
and incendiary. Both a priori 102 and emergent coding were employed. A priori coding 
was used to identify the literature source, publication year, geographical source, 103 and 
fundamental yes/no decisions. Emergent coding evolved early in the literature review to 
deduce the key criteria authors assigned that described success or failure in their findings. 
A single coder was used in the literature search. (See Appendix D for the content analysis 
codebook). 

1. Arson Threats Reported in Performance-Based Design Literature 

The search showed that arson threats were mentioned in 66.7% (n=100) of the 
literature pertinent to performance-based design and fire scenarios, including studies that 
evaluated entire building projects or sub-components, such as fire-resistive construction 
elements (e.g., structural steel, fire separations, or fire protection systems). In 68.7% 
(n=103) of the literature, the use of performance-based design was mentioned as a means 

102 Category codes selected before coding began. 

103 Some articles were pertinent to specific countries; others were generic to the engineering discipline 
and practice of performance-based design. 
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to craft a viable mitigating solution against incendiary fires. However, substantially fewer 
of the articles evaluated potential results from the use of performance-based design 
solutions. Table 37 describes the number of instances in which the potential outcome of 
the perfonnance-based design option was not addressed in the article, or was detennined 
to be an unsuitable, suitable, or situation dependent option. 

Table 37. Perfonnance-based Design Arson Mitigation Suitability Assessment 



n 

% 

Not addressed/no assessment made 

102 

68.0 

Unsuitable 

14 

9.3 

Suitable 

10 

6.7 

Situation dependent 

24 

16.0 

Total 

150 

100.0 


In the 48 instances in which an assessment was made regarding the suitability of 
perfonnance-based design solutions, one theme emerged as the predominant factor in the 
method’s success or failure, accurate description and quantification of the design fire 
scenario. The accuracy of the design fire scenario(s) was mentioned as a critical 
consideration in 34 of the 48 articles (70.8%) where the efficacy of perfonnance-based 
design solutions was discussed, and was overwhelming cited (83.3%, n=20) in the 24 
cases in which the suitability of performance-based design was deemed to be situation 
dependent. Other thematic issues identified in the literature included whether adequate 
risk assessments were included in the design proposal (e.g., quantification of the arson 
threat), the computational power and accuracy of the fire models to mimic complex real 
world conditions, the competency of the design professionals to interpret the data, and 
other miscellaneous factors. The results are included in Table 38. 
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Table 38. Factors Influencing Suitability of Performance Based Design as an Arson 

Countenneasure 


Factor 

n 

% 

Design fire scenario(s) a 

34 

70.8 

Adequate risk assessments 

5 

10.4 

Capability of computational tools 

4 

8.3 

User competency 

3 

6.3 

Other 

2 

4.2 

Total 

48 

100.0 


Note. Where more than one factor was mentioned, a simple word count was 
employed to determine which factor was given primacy by the author. 
a Three articles used examples of multiple, simultaneous design fires in their 
analysis. 

Thirty-four authors who discussed a well-defined design fire scenario stressed its 
importance, and their critical criteria varied depending upon the topic of the article. 
Eleven (32.4%) specifically mentioned the importance of having accurate HRR data to 
use in fire modeling analysis. Others employed vague descriptions, such as 
“quantification of the arson scenario,” “incomplete scenario development,” “scenario 
definition,” or “keep fire scenarios within range of acceptable values,” to express the 
need for accurate data input. 

2. References to International Design Documents 

Interestingly, given the SFPE’s international membership and advocacy on behalf 
of perfonnance-based design, its SFPE Engineering Guide to Performance Based Fire 
Protection was mentioned in only one (0.7%) of the literature examples pertaining to 
arson and perfonnance-based design reviewed. 104 Likewise, the ICC’s Performance 


104 The first edition of the SFPE guide was published in 2000. Fourteen of the articles reviewed 
(9.4%) were written in 1999 or 2000; therefore, the authors may not have been aware of this document. 
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Code for Buildings and Facilities was mentioned in a single article, a doctoral thesis 
regarding the application of systemic dynamics to building simulation for anti-terrorism 
resource allocation (Thompson, 2009). 

Two other documents, NFPA 101, Life Safety Code and NFPA 5000 Building 
Construction and Safety Code, were referenced in seven and two articles, respectively. 
These codes pennit perfonnance-based design options as alternatives to prescriptive 
regulations. Both codes employ the eight design fire scenarios of Table 16, Design Fire 
Scenarios from NFPA 101, Life Safety Code. Scenario 2, “an ultra-fast developing fire, 
in the primary means of egress, with interior doors open at the start of the fire” arguably 
is an arson scenario that, according to the NFPA code and its annex, uses gasoline 
(National Fire Protection Association, 2012). This scenario also is employed in the New 
Zealand building codes to protect occupants from intentionally set or accidental fires 
starting in a means of egress (New Zealand Ministry of Business, Innovation and 
Employment, 2012). 

C. BASELINE DESIGN FIRE SCENARIO SELECTION 

To obtain a more realistic and quantitative baseline arson scenario than that 
described in the DBT, a group of expert fire investigators was polled using the Delphi 
Method. The Delphi Method is an iterative process to collect and distill anonymous 
judgment from experts using a series of data collection techniques and feedback 
instruments (Skulmoski, Hartman, & Krahn, 2007). The technique allows the researcher 
to pose open- and closed-ended questions regarding the topic at hand to a group of 
subject matter experts. Anonymity in the process allows the participants to express their 
opinions freely without being influenced by other respondents or the researcher (Rowe & 
Wright, 1999). When the initial data is collected, the researcher analyzes the results using 
qualitative coding or statistical summaries to identify commonalities and trends among 
the responses. Upon completion of the initial analysis, participants complete a second 
survey based on the first round results, and that survey also is analyzed using the 
qualitative or statistical method. Generally, a third round of surveys is the final step 
employed in the Delphi approach. 
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The baseline design fire scenario Delphi approach employed four main steps: 
developing the questionnaire, selecting participants, administering the three-round 
survey, and analyzing the results. One part of the first round questionnaire was used to 
establish the participants’ expert credentials, and the second part was to survey their 
perception of the likelihood of the arson scenario published in the DBT. 

While the word “expert” is subjective, in criminal cases, the presiding judge 
qualifies expert witnesses individually after a review of the witness’s credentials. 
According to the Advisory Committee on Rules, Rule 702 of the Federal Rules of 
Evidence states: 

The fields of knowledge which may be drawn upon are not limited merely 
to the “scientific” and “technical” but extend to all “specialized” 
knowledge. Similarly, the expert is viewed, not in a narrow sense, but as a 
person qualified by “knowledge, skill, experience, training or education.” 

Thus within the scope of the rule are not only experts in the strictest sense 
of the word, e.g., physicians, physicists, and architects, but also the large 
group sometimes called “skilled” witnesses, such as bankers or 
landowners testifying to land values. (Legal Information Institute, 2011b) 
[Electronic edition]. 

For example, in one study of 693 federal and state criminal appellate court cases over an 
11-year period, Groscup, Penrod, Studebaker, Huss, and O’Neil (2002) found that 98% of 
the experts who testified derived some of their expertise from experience, 74.8% derived 
some expertise from case specific experience, and 62% derived their expertise through 
education. Many experts accumulated their expertise from more than one or all of the 
sources. 

Given that expertise is aggregated from experience and education, a 12-question 
survey was developed to assess respondents’ credentials in these realms before asking 
their suggestions to develop a realistic and quantitative baseline arson scenario. Tables 39 
through 41 list the questions and responses used to establish expertise. Survey subjects 
were 40 volunteer adult students recruited from the Fire/Arson Origin and Cause 
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Investigations and Interviewing and Interrogation Techniques 105 courses at the USFA 
National Fire Academy (NFA) in Emmitsburg, Maryland. Students who attend the NFA 
represent federal, state, or local government entities responsible for fire protection and 
post-incident investigation. All students must meet minimum academic criteria and 
prerequisites, and have the approval of their agency’s senior executive to attend the 
courses. Students who meet the minimum criteria are selected randomly by postal zip 
code to enhance geographic diversity in the classroom. To recruit the volunteer 
participants, a classroom instructor not acquainted with this thesis read aloud a recruiting 
message summarizing the nature and purpose of the study. Subjects were invited to 
volunteer their participation by proving an email address of their choice to which the 
survey instruments were delivered. While some students opted to use work email 
addresses in the fonnat firstname.lastname@jurisdictionaddress whereby they potentially 
could be identified, others provided personal email addresses with no identifying 
characteristics. In any case, other than the email solicitation to participate in the Delphi 
surveys, the student researcher had no contact with the subjects to permit their anonymity 
as much as reasonably possible. 

Questions related to subject experience with detennining the origin and cause of 
various fires were derived from National Fire Protection Association 921, Guide for Fire 
and Explosion Investigations, where: 

Accidental fires involve all those for which the proven cause does not 
involve an intentional human act to ignite or spread fire into an area where 
the fire should not be; natural fire causes involve fires caused without 
direct human intervention or action, such as fires resulting from lightning, 
earthquake, and wind; [and] an incendiary fire is one intentionally ignited 
under circumstances in which the person igniting the fire knows the fire 
should not be ignited. (National Fire Protection Association, 2011, p. 19- 
1 ) 


105 Th e courses address the technical and scientific knowledge and skills needed to conduct successful 
fire/arson investigations. Methods are demonstrated for conducting legal fire investigations that culminate, 
when appropriate, in prosecution for arson. Upon the completion of the courses, the students are expected 
to identify the origin and cause of a fire, conduct a technically and legally sound investigation, and pursue 
the case through the judicial system (U.S. Fire Administration, 2011). 
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The three-round survey was conducted between October 21 and January 14, 
20 1 2. 106 In each round, subjects were provided an email invitation to participate in the 
online survey. Forty subjects were invited to participate in the first round of the survey, 
with a response rate of 55% (N=22). One respondent opted not to participate in the study, 
and three others did not complete all the data fields, 107 which left 18 respondents (45% of 
those invited) to supply the data. Table 39, Survey Subjects’ Academic Credentials, 
summarizes the respondents’ academic qualifications. Table 40, Survey Subjects’ 
Professional Certifications, identifies the professional certificates they possess. 


Table 39. Survey Subjects’ Academic Credentials 



Some 

high 

school 

High 

School 

Trade 

School 

No 

Associates Bachelors Masters Doctorate Response 

What is the 
highest level 
of education 
you have 
received? 

0 

2 

2 

2 7 6 1 1 

Note. N = 21 






Table 40. 

Survey Subjects’ Professional Certifications 

n 


None 9 


International Association of Arson Investigators 10 

National Association of Fire Investigators 1 

U.S. Department of Justice Bureau of Alcohol, Tobacco, Firearms and Explosives 0 

Other 0 

Note. N=19. Total equals 20 because one respondent possesses two certifications. 


100 Authorized by Naval Postgraduate School Institutional Review Board Protocol number 
NPS.2012.0002-IR-EP7-A. 

107 Two of the three who did not complete the entire survey answered questions pertaining to their 
educational level and certifications. 
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Table 41, Survey Results: Expert Qualifications, reveals a significant variation in 
experiential skills among the survey population in the number of structure fires 
investigated and the number of times the cause of those fires was detennined to be 
accidental. Given the small sampling population, two respondents who reported they had 
reported between 1,500 and 2,000 fires each heavily skew the data. Regardless, the data 
shows the respondents are well educated (71.4% possess at least a bachelor’s level 
degree), have an average of 9.05 years of experience in fire investigation, approximately 
half have been professionally credentialed, and have investigated an estimated 252.05 
fires each during their careers. 


173 



Table 41. Survey Results: Expert Qualifications 


Question 

Mean 

SD a 

Median 

Mode 

Range 

How many years of fire and arson investigation experience do you have? 

9.05 

8.27 

5 

4 

29 

What is the number of fire and arson investigation in-service training programs you have 
attended? (This category includes local, state, national or professional association training 
programs and seminars where an educational or training component was included.) 

28.55 

59.91 

15 

30 

262 

What is the estimated number of structure fires of all types you have investigated? 

252.05 

355.35 

112.5 

300 

1994 

Of the total number of fires you have investigated, what is the estimated number of 
incendiary fires you have investigated? 

46.64 

96.33 

25 

300 

299 

What is the estimated number of times you have determined origin and cause of fires that 
were classified as accidental? 

99.5 

240.34 

50 

50 

995 

What is the estimated number of times you have determined origin and cause of fires that 
were classified as natural? 

8.73 

25.88 

2 

0 

100 

What is the estimated number of times you have determined origin and cause of fires that 
were classified as incendiary? 

29.77 

75.45 

12.5 

50 

300 

What is the estimated number of times you have given sworn testimony related to fire and 
arson investigation, including depositions and courtroom appearances? 

19.18 

9.79 

3 

0 

300 

What is the number of times you have been qualified as a fire investigation expert in state 
court? 

1.59 

1.12 

0 

0 

25 

What is the number of times you have been qualified as a fire investigation expert in 
federal court? 

1.41 

0.86 

0 

0 

25 


a SD = Standard deviation 
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In addition to establishing their credentials, in the first round participants were 
asked 108 to respond to a single closed-ended question and were given the opportunity to 
submit responses to two open-ended questions. The closed-ended question was captured 
from the DBT and employed a Likert score to measure responses. The closed-ended 
question was “In your opinion, how likely is the following arson scenario?” and the 
description was that found in the DBT: “An adversary places an improvised incendiary 
device (IID) containing an accelerant and utilizing a delay mechanism adjacent to a 
facility, but outside the view of security countermeasures.” Ordinal response options 
included Don’t Know, Highly Unlikely, Unlikely, Neutral/No Opinion, Likely, and 
Highly Likely, with corresponding scoring values ranging from 0 (zero) to 5 . Table 42 
summarizes the responses from the 18 persons who completed the survey. 

Table 42. Responses: Likelihood of Design Basis Threat Arson Scenario 


Response Option 

Responses 

% 

Highly Likely 

3 

16.7 

Likely 

5 

27.8 

Neutral/No Opinion 

2 

11.1 

Unlikely 

5 

27.8 

Highly Unlikely 

2 

11.1 

Don’t Know 

1 

5.6 

Total 

18 

100 


108 Using SurveyMonkey.com. 
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The distribution of the results shows that respondents were equally divided 
between the scenario being unlikely or likely, with a small percentage (16.7%, n=3) 
reporting the scenario to be highly likely. 

In the open-ended questions, respondents were asked to complete the following 
narratives. 

• Describe what you believe are likely or highly likely arson scenarios 
involving non-military and non-postal federal buildings or facilities 

• For your scenario(s), describe what you believe would be the first item or 
items ignited by the perpetrator 

The narrative responses were analyzed for key themes and words that resulted in 
the following nine closed-ended and one open-ended question for the second round of the 
Delphi analysis. Table 43, Second Round Results: Subject-Suggested Arson Scenarios, 
shows the nine closed-ended questions and responses. Respondents were asked to employ 
Likert techniques, and ordinal response options included No Answer, Highly Unlikely, 
Unlikely, Likely, and Highly Likely, with corresponding scoring values ranging from 0 to 
4. The frequency of each response was multiplied by the assigned scoring value, and the 
sum divided by the number of respondents to obtain the mean. The response rate to the 
second round of the survey was 35% (n=14), down four respondents from the first round. 
Table 43 summarizes their responses and ranks them according to the distribution of 
results. Table 44, Second Round Results: Item Most Likely Ignited First, presents the 
respondents’ data on the eight items they suggested would be the most likely ignited first 
by an adversary to result in a fire. In this table, the options were cloth or fabric, 
combustible container, ignitable liquid, light bulb filament, makeshift materials (garbage, 
rubbish, waste paper), paper or cardboard, a road flare, or other. Respondents were asked 
to rank them from 1 to 8, with “1” representing the most likely item first ignited, and “8” 
being the least likely item first ignited by an adversary. In Table 44, a lower mean value 
represents a higher likelihood of occurrence. 
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Table 43. Second Round Results: Subject-Suggested Arson Scenarios 


Question 

Mean 

SD a 

Median 

Mode 

Rank 

An adversary, who is an agency employee, starts a fire. 

3.0000 

11.46 

1 

1 

1 

An adversary uses liquid accelerants on the outside of the building. 

2.9286 

11.10 

2 

0 

2 

An adversary breaks a window and ignites burnable materials that can be reached 
inside. 

2.8585 

8.70 

3 

3 

3 

An adversary uses a Molotov cocktail thrown through the window or store front. 

2.8571 

8.69 

3 

3 

4 

An adversary hand-deploys incendiary devices (e.g., Molotov cocktail) at facilities 
with unsecured pedestrian access (sidewalks). 

2.6429 

7.27 

2 

0 

5 

An adversary breaks in and uses flammable liquids as an accelerant. 

2.5000 

11.45 

2 

0 

6 

An adversary places an incendiary fire ignition device around an 
accessible/unsecured perimeter. 

2.2857 

5.86 

2 

1 

7 

An adversary places the incendiary device in a mail box, homeless persons’ cart or 
bags, waste basket attached to poles. 

2.0714 

4.61 

2 

2 

8 

An adversary ignites a portable toilet with a road flare, which ignites the adjacent 
building. 

1.6428 

6.62 

1 

1 

9 


a SD= Standard deviation 
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Table 44. Second Round Results: Item Most Likely Ignited First 


Item Most Likely Ignited First 

Mean 

SD a 

Median 

Mode 

Rank 

Ignitable liquid 

1.86 

1.29 

1 

1 

1 

Paper, cardboard 

2.71 

1.14 

2.5 

4 

2 

Makeshift materials (garbage, rubbish, waste 
paper) 

3.08 

1.31 

3 

3 

3 

Cloth or fabric 

3.92 

1.56 

4 

5 

4 

Combustible container 

4.36 

1.57 

5 

5 

5 

Road flare 

5.92 

1.56 

6.5 

7 

6 

Other 

6.29 

2.43 

8 

8 

7 

Light bulb filament 

7.00 

1.04 

7 

8 

8 


Note. “Other” responses included “vehicle,” “incendiary device,” and “furnishings i.e., bedding, sofa, 
overstuffed chair, love seat.” 
a SD=Standard deviation 


For the final round, the top three results from round two were submitted to the 
survey subjects. The final round response rate was 42.5% (n=17). Tables 45 and 46 
present the final data from the experts surveyed. According to their opinions, the most 
likely arson scenario in federal buildings or facilities is one in which an adversary breaks 
a window for entry, and using makeshift materials found on the premises, ignites a fire. 


Table 45. Final Round Results: Subject-Suggested Arson Scenarios 


Question 

Mean 

SD a 

Median 

Mode 

Rank 

An adversary breaks a window and ignites burnable 
materials that can be reached inside. 

2.15 

0.69 

2 

2 

1 

An adversary, who is an agency employee, starts a 
fire. 

1.87 

0.99 

1 

1 

2 

An adversary uses liquid accelerants on the outside 
of the building. 

1.85 

0.80 

2 

1 

3 


a SD=Standard deviation 
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Table 46. Final Round Results: Item Most Likely Ignited First 


Item Most Likely Ignited First 

Mean 

SD a 

Median 

Mode 

Rank 

Makeshift materials (garbage, rubbish, 
waste paper) 

2.46 

0.78 

3 

3 

1 

Ignitable liquid 

1.73 

0.80 

2 

1 

2 

Paper, cardboard 

1.58 

0.67 

1.5 

1 

3 


a SD=Standard deviation 


While the experts rejected the idea from the ISC DBT arson scenario that an 
accelerant and delay mechanism are important components of an adversary’s IID, their 
conclusion that the attack is likely to occur along an architectural plane containing a 
window suggests that improved perimeter security would reduce the likelihood of a 
successful arson attack. The ISC DBT arson scenario was qualified by its creators that an 
arson attack would occur “outside the view of security countermeasures” (U.S. 
Department of Homeland Security, 2010b, p. 7.2.1). Additional research on the efficacy 
of perimeter security countenneasures may yield data recommending added protection 
from adversaries through enhanced human, visual, kinetic, or other technological security 
regimes. 

D. FIRE EFFECTS MODELING APPLICATION 

Fire is a dynamic phenomenon influenced by complex chemical, physical, and 
environmental factors. To study its effects under a variety of conditions without 
conducting full-scale destructive fire tests, fire research scientists and engineers have 
developed computerized mathematical fire models to simulate the effects of fire behavior 
in a virtual environment. According to Phillips (1995), “simulation models are widely 
used in science, engineering and mathematics in the study of problems that involve 
ordinary and partial differential equations (either overtly or implicitly)” (p. 5-1). In fire 
science and fire protection engineering, models can be used to simulate fire behavior, 
smoke migration, absorption of toxic products, human movement in response to 
threatening events, and the perfonnance of fire protection systems. 
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Beyler and DiNenno (2003) reported that mathematical fire models could be 
classified as either probabilistic or deterministic. They found that 

probabilistic models attempt to deal with the random nature of fire 
behavior, whereas deterministic models presume that, given a well-defined 
physical situation, fire growth and behavior is entirely detennined. Both 
approaches are valuable in understanding fire. (p. 3-70) 

Within the deterministic framework, two major categories of fire models are 
recognized throughout the fire protection community. The first is known as a zone model, 
in which the room or compartment being modeled is divided into two regions or zones. 
The upper portion of the compartment is assumed to be filled with hot combustion gases, 
and the lower portion is presumed to be filled with relatively cooler air. Each of the upper 
and lower zones is assumed to have uniform temperatures and concentrations of various 
combustion gases. While this two-layer approach does not exactly mimic the complex 
environment of a burning room, zone models are desirable due to their reliability, relative 
simplicity, ease of use, and computational speed. The second major category of fire 
model is the computational fluid dynamic (CFD) method that relies on complex, three- 
dimensional computational cells. As Beyler and DiNenno explained, the room or 
compartment being modeled is computed as potentially thousands of discrete cells and 
the temperature, air velocity, and gas concentration of each cell is calculated. A CFD 
model can be used to represent the complexity of a hostile fire environment, yet greater 
computational capacity (processing power and random access memory) and more 
detailed data input is needed to create even simple models. A widely recognized 
detenninistic CFD model (Fire Dynamics Simulator) was used in this study to represent 
conditions in the two prototypical environments. 

Beyler and DiNenno (2003) advocated the use of deterministic methods and said 
that “perhaps the most important attribute of computer fire models is their ability to 
predict accurately and realistically the relevant fire behavior within their stated 
limitations” (p. 3-71). Despite their value, it is important to remember that fire models are 
only mathematical representations of dynamic physical and chemical events, and, as 
Phillips added, “simulation models can not [sic] ever be validated over the whole range 
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of their behavior” (p. 5-7). In other words, models cannot be viewed as an absolute 
representation or prediction of what might happen during a fire; they are intended to give 
competent professional scientists and engineers an additional evaluative tool to perform 
critical analysis of potential fire phenomena. Validation studies to assess FDS’ accuracy 
at modeling pyrolysis and flame spread concluded that without “tuning” the pyrolysis rate 
coefficients, it was difficult to assess fire growth rates accurately in a combustible space 
(McGrattan, McDermott, Hostikka, & Floyd, 2010). While this conclusion does not 
invalidate the use of models, it is an acknowledgement that despite their robustness, they 
are not fully developed. Confidence in the models’ reliability is enhanced if the 
mathematical relationships are established on sound scientific theory and full-scale 
experimentation and observation by knowledgeable people. 

The Fire Dynamics Simulator (FDS) detenninistic model developed and 
maintained by the U.S. Department of Commerce NIST was selected for the fire 
consequence analysis of the Physical Security Criteria for Federal Facilities standard 
and the DBT . It is a CFD model developed more than 25 years ago to solve complex 
mathematical equations 109 that represent the flow of heat and smoke from fires. The FDS 
allows the modeler to create a three-dimensional virtual environment that represents the 
space under study. 110 The modeler is able to specify spatial dimensions, construction 
materials, doors, windows, and other openings, 111 and specify the inclusion of fire 
protection systems, such as heat detection, smoke detection, or automatic sprinklers. The 
modeler also can create and position virtual objects inside the space, such as furniture. 
Data files collected from numerous small- and full-scale fire tests provide infonnation on 
the thennal behavior and smoke generating characteristics of building materials 
(combustible or non-combustible) and furnishings. 


109 The calculations include Navier-Stokes equations that measure the movement of fluids and gases 
as they are affected by gravity, pressure and friction, direct numerical simulation for mathematically 
solving the Navier-Stokes equations and large eddy simulation to assess turbulence (Kandola, 1995; 
Ferziger, 1996). 

110 See Fire Dynamics Simulator (Version 5) User’s Guide (McGrattan, McDermott, Hostikka, & 
Floyd, 2007) for a detailed explanation of the product. 

111 Described as “vents” in the model. The operation of vents affects the air flow to the fire. 
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The FDS enables the modeler to create a variety of fire scenarios using pyrolysis 
models for solid or liquid fuels, and place the ignition source and fuels anywhere in the 
virtual space. The model also can be configured to open or close vents at various points 
in the scenario to simulate the opening and closing of doors or windows that might occur 
during a live fire event, such as when occupants open a door to escape. In some 
scenarios, supply and exhaust fans—such as those occurring in heating, ventilating, and 
air conditioning or smoke management systems—can be simulated. 

The FDS output files provide a wealth of information for assessing fire threats 
from the defined input parameters. The model is capable of providing data 112 on fire 
HRR, visibility obscuration caused by smoke development and migration, room 
temperatures, heat flows and thermal radiation, and incapacitating properties of toxic 
gases including carbon monoxide and carbon dioxide (as well as life threatening low 
oxygen concentrations). Jahn, Rein, and Torero (2008) reported that fire modeling tools 
provide good predictions of the thennal consequences of a fire, but their ability to predict 
fire development and HRR is problematic; therefore, the modeler must specify the HRR 
input variable. Results of the data runs can be produced in tabular or graphical outputs, or 
exported to another NIST computer program called Smokeview that can provide a two- or 
three-dimensional representation of the smoke, heated gases, and surface temperatures 
(Forney, 2010). 

To perform the modeling routine, the FDS requires the creation of a 
computational domain that establishes the physical dimensions of the space, as well as 
any construction or furniture features that will affect the model’s outputs. This virtual 
domain creates the boundaries for the model. According to McGrattan et al. (2007), it is 
the most challenging part of setting up the simulation because for both real and simulated 
fires, fire growth, and behavior is sensitive to the thermal properties of the environment, 
and even if all the material properties are known, the model itself may not be capable of 
rendering the fire with complete accuracy. Tables 47 and 48 in the two model test 


112 


The model also can be run with a given HRR by inputting the information as a bounding condition. 
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environments provide the physical input criteria for the bounded domains. Material 
properties for building construction and interior finish, as well as automatic fire sprinkler 
characteristics, were developed from the FDS library databases. 

The purpose for perfonning fire modeling in this study was to attempt to assess if 
one of the secondary research questions could be answered: “How can the arson threat 
scenario described in the DBT be quantified for the purposes of selecting permanent 
countermeasures?” Any fire behavior forecasts developed from the models must be 
considered blind predictions because the results are not compared to any experimental 
measures (Gissi, 2010). Virtual models of two prototypical federal properties were 
developed, 1) a single-story open office arrangement, and 2) a two-story public lobby and 
adjacent elevator shaft enclosures to represent a courthouse entrance. These examples 
were selected based on the fire incident data provide by the GSA that showed 80% of 
fires in GSA properties occurred in office buildings, and 10.9% (the second largest 
category) occurred in federal courthouses. Design fire scenarios were created by using 
the small quantity accelerant data from the Bureau of Alcohol, Tobacco, Firearms and 
Explosives. Design fire scenarios were run in both simulated environments to compare 
fire consequences and detennine if recommendations to quantify elements of the DBT 
arson example could be accomplished. 

1. Project Scope 

In accordance with the SFPE Engineering Guide to Performance-Based Fire 
Protection Analysis and Design of Buildings, the first step in performance-based analysis 
or design is to detennine the project scope to describe the boundaries of the design. The 
office and courthouse lobby scenarios were selected based upon the predominant use of 
federal properties considered in this study. 

a. Fire Model Test Environment 1: Single-Story Open Office 
Building 

The first test example represents a single-story office building created to 
support typical administrative functions, such as public access, data collection, and 
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processing, bookkeeping, records management, or contract administration. The physical 
space consists of an open plan work area surrounded by individual offices. The building 
consists of non-combustible construction, and is protected by a wet pipe automatic 
sprinkler system. (See Figure 10 for a graphical representation of the space). Support 
functions, such as restrooms, closets, and a breakroom/kitchenette, are included. The non¬ 
combustible construction and the fire sprinkler system can be considered the integral 
elements of the permanent countermeasures for this scenario’s evaluation. A perimeter 
office with an exterior window and near the rear exit is used as the room of fire origin. 


Rear Exit 


Toilets 

Breakroom 

Office 

■k (Typical) 

Open Office 


Main Entrance 


Figure 10. Fire Model Test Environment 1: Single-Story Open Office Building 

To represent the fuel package in the small office and maintain simplicity 
in the modeling, the contents of the small office were rendered as a single object 
(upholstered sofa) having the material properties of polymethyl methacrylate (PMMA) 
and a mass equal to the accumulation of combustibles found in a typical office. PMMA’s 
material properties 113 have been studied extensively in laboratory-environment live fire 
research, and are a material commonly used to represent the fuel package in modeling 
scenarios. The modeled object’s mass (1305 lbs/592 kg) was predicated on 

113 Conductivity, specific heat, density, and emissivity. 
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Madrzykowski’s (1996) full- and bench-scale fire research conducted on office work 
stations. Madrzykowski surveyed the GSA Central Office in Washington, D.C. to create 
the typical cubicle fire load for his HRR study. Having a single object as the ignition 
target from the already ignited accelerant lessened the number of furnishing obstructions 
modeled. 


Table 47. Fire Model Test Environment 1: Single-Story Open Office Physical Input 

Criteria 



Condition/Material 

U.S. Customary 
Units 

SI Units 

Room 

dimensions 

- 

11.5 x 12 ft 

3.5 x 3.67 m 

Room Area 

- 

138 ft 2 

12.5 m 2 

Floor height 

- 

0 ft 

0 m 

Ceiling height 


12 feet 

3.6 m 

Model 

dimensions 

- 

19.6x22.9x20.5 ft 

6 x 7 x 6.2484 m 

Ceiling 

configuration 

Smooth, flat 

- 

- 

Ceiling finish 

Mineral fiber lay-in 
ceiling tile 

5/8-inch 

16 mm 

Ambient 

temperature 

- 

68 °F 

20 °C 

Ambient 

relative 

humidity 

- 

40% 

40% 

Ambient 

barometric 

pressure 

- 

760 mm Hg 

101 325 Pa 

Automatic 

sprinklers 

Wet pipe 

- 

- 


Quick Response 
Sprinklers: Response 
Time Index 


185 


165 


165 




Condition/Material 

U.S. Customary 
Units 

SI Units 


Sprinkler discharge 
density 

0.10 gpm/ft 2 

139 Lpm/m 2 


Operating temperature 

165 °F 

74 °C 


Sprinkler discharge 
density 

0.10 gpm/ft 2 

139 Lpm/ m 2 


Sprinkler K Factor 

5.6 

80 


Sprinkler flow 

18 gpm 

68.1 lpm 

Floor covering 

Nylon caipet 

9/32-inch 

7.8 mm 


Bonded urethane pad 

3/8-inch 

9.5 mm 

Subfloor 

Concrete slab 

6-inch 

150 mm 

Wall material 

Gypsum wallboard on 
steel framing 

5/8-inch 

16 mm 

Vents 

Exterior window (open) 

32 ft 2 

3 m 2 


Interior door (open) 

24 ft 2 

2.23 nr 

Smoke 

management 

None 

- 

- 

HVAC 

No shutdown 

0.12 fit 3 /fit 2 

.003 m 3 /0.093 m 2 


The FDS provides results that can be captured in a spreadsheet for graphic 
representation in charts and displayed virtually using Smokeview. Figure 11 is an 
isometric rendering of design fire’s area of origin in the small office environment. 
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Figure 11. Isometric Rendering of Fire Model Test Environment 1 Area of Origin 

In the rendering, note that the exterior window is labeled “open” to represent an 
unrestricted vent to the atmosphere based on the broken window conditions of the design 
fire scenario. The upholstered sofa represents the entire fuel package in the room. The 
square beneath the upholstered sofa is the device that contains the accelerant, modeled as 
a 1 MW burner. Small dots inside and outside the room represent two virtual 
thermocouple threes with thermocouples distributed in 24-inch (61 cm) increments 
between the floor and ceiling. The virtual thennocouple tree in the office is centered in 
the room; the virtual thennocouple tree outside the room is 12 inches (30 cm) from the 
vertical plane of the door. 

During its run time, Smokeview can represent dramatically the speed with which 
life-sustaining conditions are threatened during a fire. Figure 12 illustrates the fire and 
smoke conditions in the small office only 79.2 seconds after ignition. The analysis of 
smoke obscuration on egress behavior conducted by Chu et al. (n.d.) described how 
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quickly building occupants must respond to achieve RSET; Smokeview’s rendering of the 
speed associated with these deteriorating conditions may convince skeptics of the 
importance of rapid egress. 



Figure 12. Representative Smokeview Smoke and Fire Conditions 

Smokeview also has the capability of rendering temperature variations in planar 
sections called slice files. The color palette represents different room temperatures at that 
point in the event ranging from blue (ambient) to red that signifies the highest 
temperatures achieved in the modeled environment. Figure 13 represents a temperature 
slice file taken at approximately four minutes (247.7 seconds) after ignition in the office 
that was not protected by automatic sprinklers. The turbulent fire gases at the room’s 
ceiling reach approximately 1,652°F (900°C), while the temperatures in the adjacent open 
office space range from ambient (68°F or 20°C) to about 200°F (95°C). 
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Figure 13. Representative Smokeview Slice File in Small Office Model 

Finally, when displaying renderings of test environments in which fire sprinkler 
systems are included in the model, Smokeview simultaneously can display virtual water 
droplets that represent sprinkler water discharge. Figure 14 displays this feature 
representing sprinkler operation inside the office and adjacent open space about 114 
minutes (75.4 seconds) after ignition. 
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Frame: 159 _ 

Time: 75.4 

Figure 14. Representative Smokeview Fire Sprinkler Virtual Water Droplets in Small 

Office Model 


b. Fire Model Test Environment 2: Two-Story Courthouse Lobby 

The second test example represents a portion of an unspecified-size 
federal courthouse, and consists of the public entrance into a two-story open lobby area 
on the first floor. (See Figure 15 for a graphical representation of the space). The lobby is 
adjacent and open to a large, undefined space outside the boundary of the model’s 
domain but influences the model as a vent, which in the FDS can be a large, unobstructed 
opening that allows the free exchange of entrained air and escape of combustion 
products. This large vent is identified by the two shaded areas marked “open beyond” in 
the vertical plane of the graphic. The two-story lobby includes two banks of elevators 
each having two cars in two independent shafts. The lobby contains a security station, 
assorted pieces of upholstered furniture, and an information kiosk. The overall building 
consists of fire resistive construction, and is protected by a wet pipe automatic sprinkler 
system. The fire-resistive construction and the fire sprinkler system can be considered the 
integral elements of the permanent countermeasures for this scenario’s evaluation. (Note 
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that the security station and information kiosk do not appear in this rendering; the 
composition and mass of the furniture is included in the model inputs in Table 48). 



Figure 15. Fire Model Test Environment 2: Two-Story Courthouse Lobby 

Like the rendering of the small office fire model test environment, the larger 
space is displayed by Smokeview in an image the enables the viewer a closer look at the 
pre-event conditions. Ligure 16 shows the design fire model at 60 seconds after ignition, 
and includes the virtual water droplets from the fire sprinkler system. This rendering 
includes smoke (soot) outputs. 


191 









■ >200 (kW/m3) 

Frame: 125 __ 

Time: 60.0 

Figure 16. Representative Smokeview Fire Sprinkler Virtual Water Droplets in 

Courthouse Lobby Model 

Table 48 provides the physical input criteria for the bounded domains used in the 
FDS model run. 


Table 48. Fire Model Test Environment 2: Two-Story Courthouse Lobby Physical 


Input Criteria 


Condition/Material U S ' < r" s ‘°'” a >7 

Units 

SI Units 

Room dimensions 

- 

48 x 50 ft 

14.6 x 15.2 m 

Area 

- 

2400 ft 2 

222 m 2 

Floor height 

- 

0 ft 

0m 

Ceiling height 

- 

20 feet 

6.1 m 

Model dimensions 

- 

19.6x22.9x20.5 ft 

6 x 7 x 6.2484 m 

Ceiling configuration 

Smooth, flat 

- 

- 

Ceiling finish 

TectunT (direct- 
attached) 

1.5 in 

38.1 mm 

Ambient temperature 

— 

68 °F 

20 °C 
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Condition/Material 

U.S. Customary 
Units 

SI Units 

Relative humidity 

- 

40% 

40% 

Barometric pressure 

- 

760 mm Hg 

101 325 Pa 

Automatic sprinklers 

Wet pipe 

- 

- 


Quick Response 
Sprinklers: Response 
Time Index 

165 

165 


Operating temperature 

165 °F 

74 °C 


Sprinkler discharge 
density 

0.10 gpm/ft 2 

139 Lpm/ m 2 


Sprinkler K Factor 

5.6 

80 


Sprinkler flow 

18 gpm 

68.1 lpm 

Floor covering 

Granite 

- 

- 

Wall material 

Granite 

- 

- 

Vents 

Exterior window 
(open) 

32 ft 2 

3 m 2 


Adjacent open space 



Smoke management 

None 

- 

- 

HVAC 

No shutdown 

0.12 ft 3 /ft 2 

.003 m 3 /0.093 
m 2 

Elevator recall 

Phase One 114 on lobby 
smoke detection 




a Trade name for a wood-fiber composite panel. 


The Smokeview visual representations, when combined with expert analysis of 
data outputs generated by the FDS, can be used by Facility Safety Committee members to 
evaluate the effectiveness of proposed permanent countermeasures against arson threats 
when the input data is accurately represented. 


1I 4 Elevator cars are returned to designated floor of egress. Smoke detection devices are located in the 
elevator lobbies, elevator hoistway (shaft), and elevator machine room (ASME, 2010). 
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2. Project Goals, Design Objectives and Performance Criteria 


The second step in the SFPE Engineering Guide to Performance-Based Fire 
Protection Analysis and Design of Buildings is the establishment of fire safety goals that 
normally are prescribed by the project stakeholders. The goals are generic statements 
addressing desirable outcomes, such as protecting life or property, providing for 
continuity of operations, or limiting environmental impacts of the fire (National Fire 
Protection Association & Society of Fire Protection Engineers, 2000). For the purpose of 
this thesis, the goals of protecting human life (occupants and visitors), and maintaining 
the organization’s on-going operational capability in accordance with federal continuity 
of operations requirements, were selected as the most appropriate goals for the sample 
scenarios. 

Eventually, the goals are refined into more specific design objectives and framed 
in engineering tenns so they can be measured. For office-type scenarios, federal 
regulations describe these three performance objectives in a building protected by 
automatic fire sprinklers: 1) prevent flashover in the room of fire origin, 2) limit fire size 
to no more than 950 Btu/sec (1 MW or 1000 kW), and 3) prevent flames from leaving the 
room of origin (41 CFR 102-80.115, 2005). In running the fire modeling routine, the 
demarcated times from ignition to sprinkler operation, the fire reaching 950 Btu/sec (1 
MW or 1000 kW), or flames leaving the room of origin, are critical. The shortest of the 
three times is the allowable time available for escape pennitted by the federal fire safety 
regulations when calculating the safety margin between ASET and the RSET (41 CFR 
102-80.115, 2005). Although it is recognized that a fire in the perimeter office may 
threaten the remainder of the office and impede egress during nonnal business hours, 
separate egress modeling analyses were not conducted because representative population 
data could not be obtained. 

3. Design Fire Scenarios 

Design fire scenarios are those events that the design team determines to be 

plausible based on an analysis of the property, its use and contents, nature of the 

occupants, and risk. To test the hypothesis whether performance-based fire protection 
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design methods are suitable to evaluate the effectiveness of the Physical Security Criteria 
for Federal Facilities permanent countenneasures, the data collected in the Delphi survey 
was used to create the modeling framework described in these scenarios. According to 
the Delphi results, the most likely arson scenario in a federal building or facility would be 
“an adversary breaks a window and ignites burnable materials (make shift materials: 
garbage, rubbish, waste paper), that can be reached inside.” To complicate the scenario, a 
1,000 kW (1MW) burner representing a flammable liquid IID was included as a model 
input. Figure 17 represents the heat release rate signature of the IID. The models were run 
both with and without the operation of the automatic fire sprinkler systems specified in 
the model inputs (Tables 47 and 48). The automatic sprinkler systems characterize the 
permanent countenneasures being evaluated. 


Heat Release Rate 
(Kilowatts) 



Figure 17. HRR Signature of Improvised Incendiary Device 


4. Pass-Fail Criteria 

The design fire scenarios were employed not to test the perfonnance of any 
hypothetical or real designs, but to determine if quantifying the character of a fire could 
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aid in evaluating the range of pennanent countenneasures. Consequently, simple pass-fail 
criteria were established to assess the results of the design fire model runs. Given that 
federal regulations specify three perfonnance objectives in a building protected by 
automatic fire sprinklers, any of the following results qualified as a successful model 
outcome: 1) prevent flashover in the room of fire origin, 2) limit fire size (HRR) to no 
more than 950 Btu/sec (1 MW or 1000 kW), and 3) prevent flames from leaving the room 
of origin (41 CFR 102-80.115, 2005). For the purposes of evaluation, flashover was 
defined as a temperature of 1,112°F (600°C) (Drysdale, 2002, p. 306) at six inches 
(152 mm) below the ceiling. Establishing whether flames leave the room of origin is 
problematic in the virtual environment because of the subjective interpretation of what 
constitutes “flames.” Flames are a mixture of fire gases and soot particles that emit 
visible and infrared light. Depending upon where they are observed in a room fire—and 
what part of the flame is being evaluated—their temperatures may range from 1,652°F 
(900°C) in what is called the continuous flame region to about 608°F (320°C) at the 
flame tip (McCaffrey, as cited in Babrauskas, 2006). The FDS does not measure flame 
temperature. Therefore, the ability through modeling to assess whether flames leave the 
room of origin is susceptible to subjective interpretation. To establish if or when flames 
left the room of origin, flame temperature was defined as visual products of combustion 
transported by fire gases at 1,500°F (815°C), and was measured by a single virtual 
thermocouple tree located in the open portion of the office building adjacent to the rear 
path of egress, and in the open areas behind the elevator shafts in the two-story 
courthouse lobby. 

5. Results 

To display some of the data sets available to Facility Safety Committee members 
who might employ the FDS and Smokeview as decision-guiding tools in their evaluation 
of proposed permanent countermeasures, the models were run with the test environments 
represented both as protected by automatic fire sprinklers and without sprinkler 
protection. No first order analysis was performed; all data results were obtained from the 
FDS based on the criteria provided in Tables 47 and 48. The second condition (no 
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sprinklers) represents circumstances in which sprinklers may be absent from the building 
design and construction, or they have been disabled through carelessness or malicious 
action, such as might occur if an adversary were trying to destroy a building by fire. 

It must be emphasized that the results presented in this paper are based on 
mathematical models only, and may not represent actual fire conditions or behavior. Any 
mathematical analysis includes an amount of uncertainty, as well as expert analysis and 
interpretation of the results. 

a. Fire Model Test Environment 1: Single-Story Open Office 
Building 

Results from Fire Model Test Environment 1, the single story open office 
building, are portrayed below. One of three perfonnance objectives mandated under 
federal fire safety regulations (41 CFR 102-80.115, 2005) is that flashover in sprinklered 
buildings must be prevented in the room of origin. For this thesis and the fire models, 
flashover was defined as a temperature of 1,112°F (600°C) at 6 inches (152 mm) below 
the ceiling. Figures 18 and 19 display the temperature outputs in two-foot (610 mm) 
increments inside the small office. In the office protected by quick response automatic 
sprinklers (operating temperature 165°F [74°C]), the temperature spikes to about 527°F 
(275°C) within the first 30-35 seconds until the sprinkler operates and begin to 
dramatically cool the atmosphere between three and 11 feet (914 to 3,352 mm) above the 
floor. After the first minute, the temperature in that zone remains between 122 and 302°F 
(50-150°C). 
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Figure 18. Small Office Temperature Curves with Sprinklers 



Figure 19. Small Office Temperature Curves without Sprinklers 
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According to the data presented in Figure 18, flashover is never achieved 
in the office space protected by automatic sprinklers; whereas without sprinkler 
protection, flashover at six inches (152 mm) below the ceiling is reached between 50 and 
100 seconds (approximately 80 seconds) after ignition (Figure 19). The temperature in 
the non-sprinklered space continues to rise to about 1,472°F (800°C) within six inches of 
the ceiling, and anywhere from 572 to 1,472°F (300 to 800°C) throughout the entire 
habitable space. 

These conditions are visually rendered in Figures 20 and 21, which are 
slice files captured 330.7 and 326.4 seconds after ignition with corresponding 
temperature ranges, respectively. 115 In both cases, even if a reviewer were unable to 
interpret the scientific data, the emotional responses to the represented color spectrum 
suggest areas within the space ranging from tolerable to dangerous to human occupancy 
(Valdez & Mehrabian, 1994). The blue end of the spectrum represents survivable 
temperatures from 68 to 131°F (20 to 55°C) where the orange-red end of the spectrum 
represents temperatures from 572 to almost 1,700°F (335 to 920°C) that could not 
support human life in a normal office environment. 


Note the open vent at the left side midpoint of the illustrations in both Figures 19 and 20. This vent 
represents the adversary’s access point—by breaking the window—that provides both additional air for 
combustion and a path for the fire. 
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Frame: 689 
Time: 330.7 I 

Figure 20. Temperature Slice File in Sprinklered Small Office 



Time: 326.4 

Figure 21. Temperature Slice File in Non-sprinklered Small Office 















The second criterion needed to satisfy federal building safety regulations 
is that the fire size is limited to no more than 950 Btu/sec (1 MW or 1,000 kW). Figures 
22 and 23 represent the fire size in terms of HRR that describe the amount of heat 
released over a unit of time by one or more burning objects (See Table 22). 



- Total HRR 

- 11D HRR 


Figure 22. Sprinklered Small Office FIRR 
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Figure 23. Non-sprinklered Small Office FIRR 


In both scenarios, the virtual fires exhibit rapid growth, and exceed the 
950 Btu/sec (1,000 kW or 1 MW) limit in less than 30 seconds. This behavior is 
consistent with the ultrafast T HRR curve shown in Figure 8 and can be employed as an 
important constituent in setting the design fire criteria used to analyze performance-based 
design solutions. As Figure 22 shows, except for several anomalous spikes between 100 
and 120 seconds, the peak FIRR occurs at about 2,370 Btu/sec (2,500 kW or 2.5 MW) at 
120 seconds and begins a steady downward trend as the operating sprinklers control the 
fire toward extinction. This HRR represents the energy released by the IID and the 
furnishings and other combustibles in the space, as well as the re-radiative influence of 
the enclosure. The fire drops below the 950 Btu/sec (1 MW or 1,000 kW) threshold at 
about 420 seconds (7 minutes) after ignition. The HRR curve corresponds to the IID 
HRR curve such that an approximately 950 Btu/sec (1,000 kW or 1 MW) difference 
occurs between the two at any point within the federal criteria. 
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However, in the non-sprinklered space, the peak HRR is about 5,686 
Btu/sec (6,000 kW or 6.0 MW) at about 120 seconds, and trends downward only slightly 
during the remainder of the model run (an additional 360 seconds or six minutes), which 
suggests the small office remains a highly energized environment throughout the duration 
of the incident due to the amount of fuel and re-radiative effects of the enclosure. The 
absence of automatic sprinkler protection renders this space untenable, and a failure to 
meet the federal lire safety criteria. 

Finally, the federally mandated third performance objective for lire 
protection in office occupancies is to coniine the flames to the room of origin. For this 
scenario, a flame temperature was defined as visual products of combustion transported 
by fire gases at 1,500°F (815°C), and was estimated by a single virtual thermocouple tree 
located in the open office space outside the small office defined as the room of lire 
origin. 

Figures 24 and 25 represent the temperature ratings at 24-inch (610 mm) 
intervals 12 inches (30 cm) outside the small office. In neither case (sprinklered or non- 
sprinklered) did the flame temperature outside the office exceed the 1,500°F (815°C) 
performance threshold. 
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Figure 24. Flame Temperature Outside Small Office Room of Origin (Sprinklered) 



I Foot 
3 Feet 
5 Feet 
7 Feet 
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II Feet 


Figure 25. Flame Temperature Outside Small Office Room of Origin (Non-sprinklered) 
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Data points in Figure 25 demonstrate what appears to be an anomaly, 
temperatures at 5 and 7 feet above the floor (1,524 and 2,134 mm) are higher than those 
at nine or 11 feet (2,743 or 3,533 mm). Normally, higher fire temperatures are recorded at 
the highest point of an enclosure in which the thennal plume reaches the ceiling. The 
apparent discrepancy can be explained by the design of the wall between the small office 
and the open area, and position of the virtual thermocouples. Notice in Figures 13 and 21, 
the wall where the office door occurs is designed with a lintel approximately 5 feet (1,524 
mm) down from the ceiling that provides a solid barrier between the small office and 
open area. This lintel limits the flaming ceiling jet and turbulent outflow in the small 
office from escaping into the open area. The doorway (a vent) between the two spaces is 
located beneath the lintel, and allows flames to escape the room of origin at the 5 to 7 
foot range (1,524 and 2,134 mm) where they are detected by the virtual thermocouples. 

b. Fire Model Test Environment 2: Two-Story Courthouse Lobby 

The second test environment represents a portion of an unspecified-size 
federal courthouse, and consists of the public entrance into a two-story open lobby area 
on the first floor. (See Figure 15 for a graphical representation of the space). The model 
was subjected to the same design fire test stress as the small office building. Figures 26 
and 27 represent the temperatures at different elevations for a lobby protected by 
automatic fire sprinklers and one that is not, respectively. In Figure 26, the temperature 
near the second-floor ceiling at 19 feet (5,791 mm) above the floor ranges between 248 to 
320°F (120 to 160°C) whereas the temperature range at the walking surface range from 
68 to 140°F (20 to 60°C). In the non-sprinklered lobby (Figure 27), the ceiling 
temperature nearly reaches flashover (spiking at 932°F [500°C] at about 120 seconds), 
while after 60 seconds, the walking surface temperatures remain dangerously high 212 to 
257°F (100 to 125°C). 

In neither case did the design fire reach the critical flashover temperature 
of 1,112°F (600°C) at six inches (152 mm) below the ceiling. Therefore, this design can 
be interpreted as meeting one of the three fire safety criteria codified in federal law. 
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Figure 26. Courthouse Lobby Temperature Curves with Sprinklers 
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Figure 27. Courthouse Lobby Temperature Curves without Sprinklers 
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Figures 28 and 29 are slice files of the virtual courthouse lobby at 326.4 
and 331.2 seconds after ignition, respectively. While both images evoke an emotional 
response that suggests the environment might easily support human life, it is important to 
note the difference in temperature scale at the right hand side of the illustration. The color 
spectrum in Figure 28 (the sprinklered lobby) ranges from 59 to 599°F (15 to 315°C), 
while the temperatures in Figure 29 range from 68 to 1,148°F (20 to 620°C). A FSC 
reviewing modeling data should insist that data be represented consistently in a fashion 
that permits balanced analysis. 



Frame: 680 
Time: 326.4 


I >200 (kW/m3) 


Figure 28. Temperature Slice File in Sprinklered Courthouse Lobby 
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Figure 29. Temperature Slice File in Non-sprinklered Courthouse Lobby 

The second performance objective in federal fire safety criteria (the FIRR 
not exceeding 950 Btu/sec [1 MW or 1,000 kW]) is surpassed in less than 30 seconds in 
both the sprinklered and non-sprinklered scenarios (Figures 30 and 31, respectively). This 
behavior is consistent with the ultrafast t FIRR curve shown in Figure 8 and is an 
important constituent in setting the criteria to analyze perfonnance-based design 
solutions. For the most part, the sprinkler system cools the environment and keeps the 
total FIRR within 950 Btu/sec (1,000 kW or 1 MW) of the IID HRR curve. However, 
between 100 and 200 seconds, HRR values exceed this difference. Those data simply 
may be the result of sensitivity issues in the modeling. According to McGrattan (2007), 
the FDS may produce results having a difference of as much as 15% above or below 
actual HRR. For the purpose of this thesis, with the limited number of model runs and the 
fact a period exists in which the total HRR exceeds the performance threshold, it must be 
concluded that is uncertain whether the sprinkler system is an effective countermeasure. 
Consequently, this specific scenario needs additional study and analysis. 

Figure 31, the non-sprinklered lobby space, shows the total HRR that 
exceeds the permitted threshold by 1,900 Btu/sec (2 MW or 2,000 kW) or more, which 
thus, does not comply with federal fire safety criteria. 
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Figure 30. Sprinklered Courthouse Lobby HRR 
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Figure 31. Non-sprinklered Courthouse Lobby HRR 


209 



























The final scenario modeled in this environment was to determine whether 
the flames left the room of origin. To assess this result, flame temperature was defined as 
visual products of combustion transported by fire gases at 1,500°F (815°C) measured at 
the virtual thermocouples in the egress path. Figures 32 and 33 represent this data. While 
the peak ceiling temperature in the sprinklered area was measured at 356°F (180°C) in 
the sprinklered building and 662°F (350°C) in the non-sprinklered building, the model 
runs in both configurations produced temperatures substantially lower than the designated 
limit. 
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Figure 32. Courthouse Lobby Egress Path Temperatures (Sprinklered) 
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Figure 33. Courthouse Lobby Egress Path Temperatures (Non-sprinklered) 


The purpose of the modeling analysis was not to validate any particular 
design, but to illustrate how modem fire modeling tools, such as the FDS and Smokeview, 
can be employed to perfonn pre-design and construction analysis to evaluate not only 
threats, but analyze a variety of proposed permanent countermeasures. In the examples 
shown, the quantified threat was defined by a sample of expert fire investigators who 
described a plausible fire threat scenario. This threat scenario was applied in the model to 
four different configurations using automatic fire sprinkler protection as the designated 
permanent countermeasure. Table 49 summarizes the results of the model outputs 
comparing the permanent countermeasures to the three legally mandated fire safety 
perfonnance objectives. 
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Table 49. Fire Modeling Test Result Summary 




Prevent 

Flashover 

Limit Fire 
Size 

Confine Flames 
to Room of 
Origin 

Small Office 

Sprinklered 

Pass 

Pass 

Pass 

Small Office 

Non-sprinklered 

Fail 

Fail 

Pass 

Courthouse Lobby 

Sprinklered 

Pass 

Uncertain 

Pass 

Courthouse Lobby 

Non-sprinklered 

Pass 

Fail 

Pass 


Modeling applications offer the ability to quantify the character of the data 
inputs. For the FDS and Smokeview, the building occupancy type, its construction 
materials and size, and the fire protection features can be defined in a virtual world and 
one or more threats applied to it. Altering any one of these variables can provide outputs 
against which permanent countermeasures can be assessed. 

E. SUMMARY 

The mixed methods research approach provided a multi-focused picture of several 
factors that must be considered to conduct a thorough policy analysis. Results from the 
national fire incident data analysis, the thematic content analysis, the Delphi survey of 
fire service professionals, and the fire modeling scenarios, provided a variety of data sets 
that enabled agglomeration of their results to better interpret the elements that comprise 
the Physical Security Criteria for Federal Facilities standard and the DBT to conduct a 
more complete policy analysis. The modeled scenarios, given a clear set of inputs, 
provide persuasive data outputs and illustrations that can explain how proposed 
protective countermeasures can be evaluated. 
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VIII. CONCLUSIONS AND RECOMMENDATIONS 


As the nation’s largest property manager, the federal government owns and 
maintains buildings and facilities in which its employees and visitors are subject to a 
variety of threats ranging from terroristic attacks to natural disasters. To enhance security 
against a variety of threat scenarios, the DHS ISC has created a Physical Security 
Criteria for Federal Facilities standard to reduce risk and consequences of unwanted 
threats. This standard uses a risk management assessment approach to determine levels of 
physical and operational protection expected to minimize the consequences of attacks. 
This thesis argues that the results collected through this risk management assessment 
devolve into past-practice prescriptive countermeasure solutions that may not be best 
suited to protect facilities and occupants from varied threats; and the use of performance- 
based design methods could help FSC address identified threats with custom solutions. 

A. RESEARCH CONCLUSIONS 

1. Primary Research Question Answered 

The primary research project focused on one threat identified in the DBT 
document that accompanies the Physical Security Criteria for Federal Facilities, the 
arson scenario in which “an adversary places an improvised incendiary device (IID) 
containing an accelerant and utilizing a delay mechanism adjacent to a facility, but 
outside the view of security countermeasures” to detennine how perfonnance-based 
design methods could evaluate the effectiveness of the Physical Security Criteria for 
Federal Facilities permanent countenneasure options to arson threats. 

The fire data research element showed that overall, federally owned, and occupied 
buildings and facilities perform well when threatened by accidental or intentional fires. 
Over a three-year study period, 86.4% of fires in federal office buildings were confined to 
the room or object in which the fire started, compared to 18.1% of the non-federal office 
buildings. Similarly, in federal courthouses, fires were contained to the room or object of 
origin 33.1% of the time, compared to 8.1% in non-federal courthouses. Additional 

213 



research is warranted to identify factors influencing the outcomes 116 between federal and 
non-federal properties. However, given the comparative success of containing fires to the 
object or room of origin in conjunction with the preponderance of accidental ignition 
sources in federal buildings, 117 it appears the “applicable construction [and life safety] 
standards” cited in the Physical Security Criteria for Federal Facilities and the DBT are 
adequate to satisfy the primary goal of life safety and the secondary goals of property 
protection and environmental controls. 

The thematic analysis of the use of performance-based design as a 
countermeasure to arson threats was less definitive. Evidently, performance-based design 
has not been given significant consideration in the international literature as a means to 
design buildings and fire protection features to protect from an arson attack. In a review 
of 150 articles on the subject of perfonnance-based design for fire safety, slightly more 
than two-thirds of the authors did not mention its suitability against incendiary fires. 
More significant, however, was the emphasis on scenario design. Nearly 71% of the 
authors who evaluated its effectiveness to counter incendiary threats stressed the 
importance of well-defined design fire scenarios. This thesis has argued the Physical 
Security Criteria for Federal Facilities arson scenario 118 is too vaguely defined for the 
development of effective countenneasures. The thematic analysis results support this 
hypothesis. 

The Delphi survey approach produced an arson threat scenario quite different 
from that described in the Physical Security Criteria for Federal Facilities. Rather than 
using an accelerant-based IID with a timing device, the experts developed a scenario in 
which an adversary simply breaks into the building or facility and employs makeshift 
aids (e.g., waste paper, garbage, other combustible materials at hand) to fuel a fire. To 
enhance the value of this scenario as an element in a perfonnance-based design, it must 

116 Among others, factors could include the existence of automatic fire detection and suppression 
systems, fire resistive construction with automatic opening protectives (e.g., fire doors and dampers), 
aggressive enforcement of safety rules and regulations, or an employee culture commitment to maintaining 
a safe working environment. 

117 Only 5.4% of fire incidents were malicious. 

118 In which "an adversary places an improvised incendiary device (IID) containing an accelerant and 
utilizing a delay mechanism adjacent to a facility, but outside the view of security countermeasures.” 
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be improved by additional qualification and quantification to describe better the location 
of where the fire was set in relation to walls, ceilings, doors or windows, as well as have 
a more specific description of the type and amount of combustible materials ignited. 

Finally, the results of the fire effects modeling exercises show that by quantifying 
the criteria for both the design fire scenario and countenneasure features (e.g., 
construction type, fire protection features, fuel controls), a blind prediction of outcomes 
that meet federal fire safety requirements can be obtained. 

2. Secondary Research Questions Answered 

In addition to the primary question of the applicability of performance-based 
design methods to federal building and facility protection, this thesis included three 
secondary research questions. 

• How can the arson threat scenario described in the DBT be quantified for 
the purposes of selecting permanent countermeasures? 

As shown in the results of the thematic literature review, the quantification of the 
design fire scenario is critical to the evaluation of the modeled results, including 
countermeasures. The DBT arson scenario in which “an adversary places an improvised 
incendiary device (IID) containing an accelerant and utilizing a delay mechanism 
adjacent to a facility, but outside the view of security countermeasures” would be 
quantified by defining input parameters, such as the type and amount of accelerant, 
description of the facility construction, and spatial relationship of the IID to the facility. 
For example, the scenario could be rewritten “an adversary places an improvised 
incendiary device (IID) containing five gallons (19 L) of gasoline and utilizing a delay 
mechanism on an asphalt surface six inches (152 mm) from a 24-foot (7315 mm) exterior 
wall comprising four-inch (102 mm) brick installed over 10 mil moisture barrier applied 
to 0.625-inch (15.9 mm) oriented strand board supported by two by four-inch (51 by 102 
mm) and clad on the interior with 0.625-inch (15.9 mm) Type-X gypsum wallboard, but 
outside the view of security countenneasures. The IID is placed 36 inches (914 mm) 
beneath a sealed vinyl frame window measuring 42 inches (1,067) wide by 48 inches 
(1,219 mm) tall.” While the latter scenario details require extra effort to account for each 
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potential condition, in terms of fire safety perfonnance, it provides the infonnation 
needed to perfonn a successful blind prediction of the consequences the IID would have 
on the building or facility. 

• Are the design methods published in the SFPE’s SFPE Engineering Guide 
to Performance Based Fire Protection or the ICC’s Performance Code for 
Buildings and Facilities suitable tools to evaluate pennanent 
countenneasure options to quantified arson threats? 

Although the thematic literature review showed little recognition by name of 
these two documents, 119 substantial concordance existed with the design methods 
employed by the SFPE and ICC. Figure 5 represents the SFPE perfonnance-based design 
process. The fire modeling exercise used in this thesis integrated this process to the extent 
necessary to test the hypothesis of design fire quantification. 

An added advantage of the performance-based design approach is its use of 
validated models to simulate a variety of events, and provide outputs in graphical and 
visual renderings that can be easily explained by qualified people. Input variables on the 
models can be altered and run at relatively little cost until the desired output is achieved. 

While the nomenclature of the SFPE performance-based design process differs 
from the Physical Security Criteria for Federal Facilities risk assessment model, it 
employs similar principles: defining scope, identifying goals and objectives, performance 
criteria, and developing scenarios and trial designs (countenneasures). The significant 
difference between the two is the Physical Security Criteria for Federal Facilities 
standard relies on prescriptive countenneasures for an unlimited variety of threat 
scenarios, whereas the SFPE performance-based design process allows stakeholders to 
define the threats and customize temporary or permanent countermeasures. 

• Should the ISC reports Physical Security Criteria for Federal Facilities 
and the DBT be limited to criminal or “manmade” threats as stated in the 
documents? 

Over time, the GSA, which is responsible for the construction and maintenance of 
non-military and non-postal federal property, is moving from a solely prescriptive design 

119 Only 0.7% of respondents mentioned the SFPE engineering guide by title and one doctoral 
dissertation referenced the ICC code. 
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and construction approach to encouraging the precepts of performance-based design. The 
GSA Facilities Standards for the Public Buildings sendee (PI 00) embraces performance- 
based design alternatives. 

Given the number, nature, and consequences of fires in federal facilities since 
2007 (Tables 31 through 35), the GSA construction standards perfonn well compared to 
non-federal properties. In 86.4% of the fires in federal office buildings, and 33% 120 of the 
fires in federal courthouses, the fire was contained to the room or object of origin; thus 
meeting one critical condition of the GSA’s federal fire safety regulations. If the criminal 
or “manmade” design threat scenarios in the DBT were quantified using performance- 
based design methods, keeping the Physical Security Criteria for Federal Facilities 
emphasis on criminal or “manmade” threats is appropriate. 

B. STUDY LIMITATIONS 

The following limitations on this study are acknowledged. 

First, the Delphi survey to assess the likelihood of the arson scenario published in 
the DBT was conducted among a small population of fire investigation experts, N=18. 
The distribution of the results shows that respondents were equally divided between the 
scenario being unlikely or likely, with a small percentage (16.7%, n=3) reporting the 
scenario to be highly likely. The survey enabled the experts to develop an alternate arson 
scenario based on their experience and opinion. 

To enhance the validity of the Delphi survey and its results, a larger population 
should be studied. The population should be geographically and experientially diverse, 
and likely have a high degree of skill in collecting and analyzing fire incident data. 

Second, the data assumptions created for the two modeling scenarios were 
selected arbitrarily and based on a subjective basis regarding the construction, content, 
use, and occupancy of a so-called typical federal office space and courthouse lobby. The 
criteria were used solely to demonstrate the use of the fire effects modeling as an analysis 

' 211 In federal courthouse fires, N=6; therefore, so the data set is extremely small for conducting 
meaningful analysis. 
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tool, and no claim is made that the scenarios represent real conditions that may be found 
in these occupancies. To conduct fire effects modeling with a lesser degree of 
uncertainty, the data inputs should be collected from full-scale examples. Results of the 
fire effects models that contend to represent real world scenarios should be peer reviewed 
by qualified scientists and engineers with experience in fire behavior and modeling. As 
Rein et al. (2011) expressed in their Dahnarnock, Scotland studies, even the possession of 
good input data may not result in the fire effects model representing it accurately. 

Finally, while altruistically the ultimate social goal is life safety, employee and 
visitor safety, or survival were not addressed in this study. Data on employee and visitor 
population and characteristics was not available; therefore, the study was limited to arson 
attack modes that could occur whether the building or facility was occupied or not. 
Additionally, results from the Delphi survey suggested the most likely arson scenario 
occurred when the building was not occupied or was occupied after hours by only a very 
small population, such as maintenance or housekeeping personnel. 

C. IMPLEMENTATION ISSUES 

The ISC Physical Security Criteria for Federal Facilities interim standard was 
issued April 12, 2010 for a 24-month validation period. That deadline has passed. To 
implement the policy recommendation made below, the ISC will have to review the 
proposed policy and consider reopening the validation period while it tests and validates 
the proposed methods. 

D. ISSUES FOR FUTURE RESEARCH 

Although rich and diverse sources of literature on building construction, fire 
protection, perfonnance-based designs, federal facilities, and terrorist threats are avaible, 
significant gaps worthy of additional research remain. This thesis suggests the following 
topics for future research. 
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1 . 


Fire Effects Modeling for the Sample Scenarios 


The two building fire scenarios employed in this thesis were selected solely to 
demonstrate the use of fire effects modeling as one tool that can be employed to evaluate 
pennanent countermeasure proposals against asymmetric threats. 

Sample physical world federal office and courthouse facilities should be surveyed 
to collect data on construction, fuel load, fuel array, use, and occupancy for the purpose 
of conducting fire effects modeling analysis of pennanent countenneasures already in 
place or proposed as part of the ISC facility security level assessments. 

2. Data Collection, Management and Analysis 

Considering the number, size, and value of federal government real property 
assets, comprehensive studies of fire and/or arson incidents and their impact on both 
physical property and continuity of operations are in order. It is remarkable that the GSA, 
the government’s largest non-military and non-postal property manager, has no 
meaningful instrument to collect and analyze fire and/or arson incidents, especially since 
it has been more than 10 years since the GAO identified this shortcoming. 

Additional research should be conducted to develop a data collection, 
management, and analysis instrument for federal buildings and facilities, or the GSA 
should work with the USFA NFDC to develop a “special reports” category unique to 
federal assets that could be appended to the existing NFIRS. 

3. Design Fire Scenarios 

An unending need exists for additional research on worst-case design fires, such 
as the use of accelerants and IIDs to quantify both the inputs and consequences. While 
the literature on design fires continues to grow, full-scale fire testing is time-consuming 
and expensive. Fire tests often are driven by propriety needs to develop specific fire 
protection countermeasures in government, business, and industry. A large-scale project, 
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perhaps funded by the federal government, would be useful to create a repository of 
design fire data that could be used for perfonnance-based design applications in federal 
and non-federal buildings and facilities. 

Furthennore, the specific scenario in this thesis of the two-story sprinklered 
courthouse atrium needs additional study and analysis to detennine whether automatic 
sprinkler protection can perform as a suitable countermeasure to an accelerated fire by 
keeping the HRR under 950 Btu/sec (1,000 kW or 1 MW). 

4. Application of Fire Models to Worst Case Catastrophic Design Fires 

Concurrent with full-scale fire testing, research should be conducted to measure 
the validity of existing fire effects models—or to develop new ones—that can provide 
consistent and reliable blind predictions of catastrophic design fires. As asymmetric 
homeland security threats evolve, criminals, or terrorists are likely to adapt their 
destructive methods to exploit vulnerabilities in the built environment (Leiter et al., 
2012). The federal government has an interest in maintaining current data analysis tools 
to protect its human and inanimate assets. 

5. Real Property Tenancy and Ownership 

The fire incident data accumulated for this study shows that a significant 
difference exists in fire outcomes between federally owned and occupied real property 
and all others. Does tenancy or ownership make a difference in fire prevention and 
protection? Does the fact federal buildings are under single managerial control affect fire 
incidents and outcomes? 

Research to explore the nature of fires in federal buildings and facilities could be 
used to identify important fire safety solutions that could be transferred to the public at 
large to reduce potentially the significant fire-related loss of life and property that occurs 
in the United States. 
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6. 


Fire Sprinkler System Maintenance and Reliability 


In nearly all the modeled events, the automatic fire sprinkler systems controlled 
the fires and kept the results within the parameters of the GSA’s federal fire safety 
regulations. During a four-year study, the NFPA found that where office buildings 121 
were protected by automatic sprinkler systems, the systems operated effectively 95% of 
the time and confined the fire to the room of origin in 94% of events (number of reported 
fires = 1,170) (Hall, 2010b). In those cases where the sprinklers failed to control the fire, 
64% of the failures were attributed to the systems being shut off, 17% due to lack of 
maintenance, and the balance were the result of a variety of other impairments (Hall, 
2010b). Given the success rate of properly operating sprinkler systems, research should 
be conducted on methods to enhance system reliability through regular inspection, testing 
and maintenance, and the implementation of impairment control programs. The technical 
response of sprinkler effectiveness seems evident; the research should be conducted to 
identify human failures that resulted in ineffective perfonnance. 

7. Perimeter Security Enhancements 

Results from the Delphi survey of fire investigation experts indicated a strong 
correlation between opportunistic break-ins and fires in federal buildings. Additional 
research on the efficacy of perimeter security countenneasures may yield data 
recommending added protection from adversaries through enhanced human, visual, 
kinetic, or other technological security regimes, which may prove to be a cost-effective 
solution to fire threats, if prompt response from law enforcement or facility security 
personnel can interrupt these attacks. 

8. Federal Building Safety Analysis 

A key theme of this report is the need to improve the level of detail and definition 
so event outcomes can be measured. One area that could use improvement is in the 
federal building safety analysis, 41 CFR 102-80.115, that states fire protection strategies 

121 The study included no data for courthouse buildings, nor does it discriminate between federal or 
non-federal properties. 
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are deemed successful if the selected method is able to keep flames in the room of origin. 
As discussed in some detail in the pass-fail criteria of the previous unit, the varying 
interpretations of flame characteristics and their consequences may result in inconsistent 
application of this criterion. Since flames represent visual constituents of products of 
combustion, and perhaps more importantly, are dramatically thennodynamic, the 
detennination of whether the flames left the room of origin is highly subjective based on 
the viewers’ perception. According to the CFR criteria, even if a transient flame left the 
room of origin but had no consequence on people or objects, the fire safety strategy 
would not be rendered successful. 

Furthennore, the conditions under which the room enclosure exists at the time of 
fire ignition should be defined. Flames are more likely to leave a room with open vents 
(windows or doors) than one in which these vents are closed. 

9. Performance-Based Design Applications to Other Threats 

This thesis contends that given adequate scenario infonnation, perfonnance-based 
design methods can effectively proposed and evaluate temporary or pennanent 
countermeasures against arson threats. Can the design methods be applied to other 
threats? Given the 31 different threat scenarios outlined in the DBT, it would be well to 
know if the performance-based design methods are universally applicable to a growing 
and varied number of threat conditions. 

Furthermore, existing detenninistic modeling software packages for fire and life 
safety analysis have not been validated for other threat scenarios. Research should be 
conducted to inventory and analyze for effectiveness the wide variety of modeling 
products that exist to address specific threats, such as explosive and IED blasts, vehicle- 
borne improvised explosive devices, CBRN dispersion, bio-contamination and vector 
distribution, infectious disease communicability, and even network and supervisory 
control and data acquisition (SCADA) cyberthreats. 
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E. POLICY RECOMMENDATION DERIVED FROM CONCLUSIONS 

The DHS ISC’s 2012 Physical Security Criteria for Federal Facilities standard 
establishes a baseline set of physical security criteria to be applied to federal buildings 
and facilities under its jurisdiction. It uses a risk assessment model (Figure 3) to guide 
users through a decision-making process for evaluating the levels of building and facility 
protection from a variety of threats. The foundation of the risk assessment model is found 
in a “Facility Security Level” score derived from the 2008 standard Facility Security 
Level Determination for Federal Facilities. That analysis produced a “Facility Security 
Level” score from I to V (low to critical) depending upon the facilities’ mission 
criticality, symbolism, population size, and threat to tenant agencies. The later document, 
the Physical Security Criteria for Federal Facilities standard, provides little guidance 
other than a table of prescriptive solutions on how to evaluate the identified threats and 
develop meaningful countermeasures. 

The adoption and application of performance-based design methods—including 
qualification and quantification of the threats, and clear articulation of the existing or 
proposed countermeasures—would provide those responsible for risk assessment blind 
predictions of potential outcomes. Consequently, a revised ISC risk assessment model is 
proposed to incorporate the precepts of performance-based design at two decision points 
in the process (see Figure 34: Proposed ISC Risk Assessment Model). In the suggested 
model, perfonnance-based design methods are added at Step 3 (Determine the LOP 
needed to meet risk) and Step 5 (Detennine the highest achievable LOP). Results from 
well-qualified and quantified performance-based design analysis would provide decision 
makers on the federal FSC (or even those in the design and procurement process) a level 
of confidence in the existing LOP or the proposed interim and pennanent 
countenneasures because their perfonnance has been evaluated against specific threats. 

The Physical Security Criteria for Federal Facilities standard risk assessment 
model (Figure 3) compels the FSC to identify and assess risks (e.g., threat plus 
consequence plus vulnerability) against all the 29 so-called “undesirable events” listed in 
the standard. The companion document, the DBT , includes 31 threat scenarios, some of 
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which overlap the “undesirable events” list. These scenarios (Appendix B) have been 
shown to be so vague that an effective evaluation of countermeasures is impossible. 

Step 3 in Figure 34 is a decision point where the FSC is compelled to choose if 
the existing LOPs (countenneasures) are commensurate with the risk. The only guidance 
provided to the FSC is “the security organization should detennine whether the 
countenneasures contained in the baseline LOP [levels of protection] adequately mitigate 
known or anticipated risks to the facility” (U.S. Department of Homeland Security, 
2010b, pp. 21-22). By adequately quantifying the anticipated threats and the known 
countenneasures (e.g., existing conditions), and employing suitable detenninistic 
modeling software, the FSC could anticipate with some level of confidence the building 
or facility’s ability to resist the threats. 

A second opportunity exists in the risk assessment model to employ performance- 
based design methods. At Step 5 in Figure 34, the FSC has detennined that the existing 
LOP is inadequate and must determine what must be accomplished to accept or reject the 
risks. The performance-based design approach of: 1) qualifying and quantifying the 
design threat scenarios, 2) modeling design scenarios with proposed countermeasures, 
and 3) using the outcomes to evaluate perfonnance in line with satisfactorily managing 
the risks, provides another opportunity for improved security. 
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Figure 34. Proposed ISC Risk Assessment Model 
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F. 


CONCLUSION 


This thesis evaluates the application of performance-based design methods to the 
Physical Security Criteria for Federal Facilities standard to address the specific threat of 
arson to federal buildings and facilities. It proposes a new model for physical security 
risk assessment that incorporates perfonnance-based design methods at two decision 
points to help officials make rational judgments regarding security countermeasure based 
on an analysis of the proposed threat. 

The strategic implications of this model for homeland security include, 
specifically, improving fire and life safety in federal buildings and facilities, and 
eventually providing a model construct for hardening federal targets from a variety of 
threats, enhancing federal continuity of operations, and strengthening national continuity 
of government in the face of unwanted criminal or terrorist attacks. 
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APPENDIX A. PUBLIC BUILDING DELINED 


The Administrator of General Services is responsible for the construction and 
maintenance of public buildings. According to Title 40, U.S.C. Subtitle II Part A Chapter 
33 Section 3301, the term “public building” means a building, whether for single or 
multitenant occupancy, and its grounds, approaches, and appurtenances, which is 
generally suitable for use as office or storage space or both by one or more federal 
agencies or mixed-ownership government corporations. 

In the law, public buildings include federal office buildings, post offices, 
customhouses, courthouses, appraisers’ stores, border inspection facilities, warehouses, 
record centers, relocation facilities, telecommuting centers, similar federal facilities, and 
any other buildings or construction projects that the President of the United States 
considers to be justified in the public interest. 

The tenn does not include those building or construction projects on the public 
domain (including that reserved for national forests and other purposes); are on US 
government property in foreign countries; are on Indian and native Eskimo property held 
in trust; are on land used in connection with federal programs for agricultural, 
recreational, and conservation purposes, including research in connection with the 
programs; are on or used in connection with river, harbor, flood control, reclamation or 
power projects, for chemical manufacturing or development projects, or for nuclear 
production, research, or development projects; are on or used in connection with housing 
and residential projects; are on military installations (including any fort, camp, post, 
naval training station, airfield, proving ground, military supply depot, military school, or 
any similar facility of the Department of Defense); belong to installations of the 
Department of Veterans Affairs used for hospital or domiciliary purposes; or the 
President of the United States considers to be excluded from the public interest (Legal 
Infonnation Institute, 2011c). 
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APPENDIX B. UNDESIRABLE EVENTS AND DBT SCENARIOS 


The DBT includes the following 31 threat scenarios (Table 50) to be used for 
threat analysis and countenneasure planning. 


Table 50. Undesirable Events and DBT Scenarios 


Undesirable Event 


Aircraft as Weapon 


_ Design Basis Threat Scenarios _ 

Deliberately crashing a Cessna 172 Skyhawk (or 
similar) into a facility. The Cessna 172’s 
characteristics are as follows: 

a) Maximum cruise speed: 126 knots (233 km/h) 

b) Maximum takeoff weight: 2,550 lbs (1157 kg) 

c) Useable fuel capacity: 318 lbs (144 kg) 

d) Full fuel payload: 523 lbs (237 kg) 

e) Range: 610 mn (1130 km) 

f) Height: 8 ft 11 in (2.72 m) 

g) Length: 27 ft 2 in (8.28 m) 

h) Wingspan: 36 ft 1 in (11 m) 


Arson 


An adversary places an IED containing an accelerant 
and utilizing a delay mechanism adjacent to a facility, 
but outside the view of security countermeasures. 


Assault 


Single assailant anned with a blunt weapon. 


An individual enters a facility and begins to attack 
Ballistic Attack-Active occupants using multiple handguns or a handgun and a 

Shooter rifle. 


An individual anned with a rifle fires indiscriminately 
Ballistic Attack-Small Arms at a facility from outside. 


Ballistic Attack-Standoff 
Weapons 


An individual assaults a large federal building using a 
homemade mortar using a fused explosive projectile. 
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Undesirable Event 


Breach of Access Control 
Point-Covert 


Breach of Access Control 
Point-Overt 


CBR Release—External 


CBR Release—Internal 


CBR Release—Mailed or 
Delivered 


CBR Release - Water 
Supply 


Civil Disturbance 


Coordinated or Sequential 
Attacks 


Disruption of Building and 
Security Systems 


_ Design Basis Threat Scenarios _ 

An individual enters a federal facility with a large 
group of visitors and displays a counterfeit 
identification badge. 

An adversary uses a handgun in an effort to breach 
security at the entrance checkpoint with the intent to 
proceed inside the facility. 

A single adversary releases chlorine gas in the area of 
an air intake. 

A single adversary releases Sarin gas by dispersing it 
in the lobby of a federal building. 

An envelope containing Ricin is mailed to a facility. 


One to three adversaries access on-site potable water 
supply piping at a valve without backflow protection 
and pump a highly lethal, tasteless, odorless agent into 
the system under pressure, or, 

At a facility with large water storage tanks or 
reservoirs, adversaries access the water supply and 
dump a non-lethal contaminant into the water. 

During a planned demonstration, a subset of protesters 
turns violent and uses available on-site materials to 
attempt to breach or damage the entrance to a facility. 

Assault by a team of 4-12 adversaries, each armed 
with an assault-style rifle and handgun. The assault 
may be of a suicidal nature and will also involve the 
use of small IEDs. 

One to three adversaries gain access to the power 
supply to several of the building’s Closed Circuit 
Television (CCTV) cameras with the intent to disable 
the cameras. 
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Undesirable Event _ Design Basis Threat Scenarios _ 

A package approximately the size of a shoebox 
containing a pipe bomb is initiated by opening the 
package. 

The pipe bomb will be Polyvinyl Chloride (PVC)-pipe 
to reduce weight, and contain approximately two 
Explosive Device—Mailed pounds of black or smokeless powder. The device will 

or Delivered also contain added shrapnel, such as nails or metal ball 

bearings. Black or smokeless powder has an 
approximate TNT equivalency factor of 0.55. Two 
pounds of black powder would have a TNT 
equivalency of 1.1 pound of TNT. 

A device concealed in a backpack is placed near an 
entrance to a facility. 

The IED will consist of approximately four pounds of 
black or smokeless powder in galvanized pipe bombs. 
The devices will also contain added shrapnel, such as 
Explosive Device—Man- nails or metal ball bearings. The device may also 

portable External contain steel plates to direct the force of the explosion 

towards the entrance. The device will be detonated by 
a timer mechanism. Black or smokeless powder has an 
approximate TNT equivalency factor of 0.55. Four 
pounds of black powder would have a TNT 
equivalency of 2.2 pound of TNT. 

A device concealed in a backpack is placed on a public 
area inside a facility. 

The IED will consist of approximately four pounds of 
black or smokeless powder in galvanized pipe bombs. 
The devices will also contain added shrapnel, such as 
Explosive Device—Man- nails or metal ball bearings. The device may also 

portable Internal contain steel plates to direct the force of the explosion 

towards the entrance. The device will be detonated by 
a timer mechanism. Black or smokeless powder has an 
approximate TNT equivalency factor of 0.55. Four 
pounds of black powder would have a TNT 
equivalency of 2.2 pound of TNT. 
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Undesirable Event 


Design Basis Threat Scenarios _ 

A suicide/homicide bomber enters an occupied public 
space in the facility and detonates a suicide vest. 

The device consists of five pounds of TNT-equivalent 
Explosive Device— explosive, activated by a switch carried by the 

Suicide/Homicide Bomber adversary. The type of explosive is known to vary 

widely. The device will also contain added shrapnel, 
such as nails, screws, nuts and bolts, or metal ball 
bearings. 

In a location in which vehicles are not subject to 
screening for VBIEDs, a passenger sedan with an 
ammonium nitrate-based charge of 200 pounds of TNT 
equivalency concealed in a trunk, initiated by a timer 
or other delay mechanism, such as a fuse. 

In a location in which vehicles are subject to screening 
for VBIEDs by use of physical inspection of the trunk, 
Explosive Device—Vehicle- passenger compartment, undercarriage, etc., a 

Borne IED passenger sedan with an ammonium nitrate-based 

charge of 50 pounds of TNT equivalency concealed in 
sealed void spaces (door panels, gas tanks, etc.), 
initiated by a timer or other delay mechanism. 

The ammonium nitrate mix is known to vary, which 
may result in substantially different TNT equivalency 
factors. 


Hostile Surveillance 


Insider Threat 


Adversaries utilize the Internet to obtain open source 
material on a potential target, and a team of two 
conducts surveillance from a nearby pubic location to 
observe specific operational details of the target in 
preparation for a possible attack. 

Insider threat acts include a broad range of acts, from 
secretive acts of theft or subtle fonns of sabotage to 
more aggressive and overt forms of vengeance and 
sabotage. The coordination of insider threats in 
perpetration of any other undesirable events is likely to 
lead to a greater chance of success. 
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Undesirable Event 

Design Basis Threat Scenarios 


Two adversaries with handguns attempt to abduct a 
senior federal employee from a parking lot area, or, 

Kidnapping 

In facilities with a childcare center, an unarmed, non¬ 
custodial parent attempts to enter a controlled area and 
abduct a child. 

Release of On-site 

Hazardous Materials 

An adversary accesses external storage tanks of 
hazardous materials and manipulates valves or 
connections to create a leak. 


Single assailant anned with a semi-automatic handgun 
confronts an employee at a cash window (or similar 
disbursement location where valuables are stored), or, 

Robbery 

Single assailant anned with a knife confronts an 
employee approaching his vehicle in the rear parking 
lot of the facility. 

Theft 

Single perpetrator authorized to have access, using 
stealth to obtain and conceal the property while 
removing it from the facility. 

Unauthorized Entry— 

Forced 

Two adversaries, equipped with hand tools, including 
crowbars, hammers, channel locks, vise grips, and 
screwdrivers. 

Unauthorized Entry— 
Surreptitious 

A single adversary gains entry to a facility through an 
unsecured door or window. The adversary is capable 
of accessing a second-story window or one-story roof 
by using available means to climb. 

Vandalism 

Unknown adversaries painted graffiti on facility walls 
or external assets. 

Vehicle Ramming 

A 4,700-pound pickup or sport utility vehicle traveling 
at 35 miles per hour attempts to ram into a facility. 


233 



Undesirable Event 

Design Basis Threat Scenarios 


An employee under duress from a job-related situation 
enters the facility and assaults co-workers using a 
handgun, or, 

Workplace Violence 

Co-workers in the office get into a verbal 
confrontation resulting in one physically assaulting the 
other. 
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APPENDIX C. CONVERSION FACTORS 


Table 51. Common Conversion Factors for United States Customary to SI Units (From: 

Quintiere, 1998) 



United States customary units to SI 

SI to United States customary 
units 

Length 

1 inch = 25.4 millimeter 

1 millimeter = 0.0393 inch 


1 inch = 2.54 centimeter 

1 centimeter = 0.3937 inch 


1 foot = 0.3048 meter 

1 meter = 3.2808 feet 

Area 

1 yard 2 = 0.8361 meter 2 

1 meter 2 = 10.7639 feet 2 

Mass 

1 lb = 0.4535924 kilogram 

1 kilogram = 2.20462 lbs 


1 oz = 28.34952 gram 

1 gram = 0.0022046 lb 

Density 

1 pound 3 = 16.0186 kg/meter 3 

1 kg/meter 3 = 0.06243 pounds per 
foot 3 

Energy 

1 Btu = 1.055056 kilojoule 

1 kilojoule = 0.94783 Btu 

Heat 

1 Btu = 1.055056 kilojoule 

1 kilojoule = 0.94783 Btu 


1 calorie = 0.004168 kilojoule 

1 kilojoule = 238.846 cal 


1 Btu = 251.9958 cal 

1 calorie = 0.003968321 Btu 

Heat release 

1 Btu/hour = 0.293071 lwatt 

1 watt = 3.4121 Btu/hour 

rate 

1 Btu/hour = 0.00293071 lkilowatt 

1 kilowatt = 3412.1 Btu/hour 


1 Btu/hour = 2.93071 le-007 megawatt 

1 megawatt = 3,412,142 Btu/hour 

Pressure 

1 lb/per inch 2 =0.06804596 

1 atmosphere = 14.69695 lbs/per 


atmosphere 

inch 2 

Temperature 

1 degree Fahrenheit = (°C x 1.8)+32 

1 degree Celsius = (°F - 32)/1.8 


Table 52. Alternative Energy Units 


1 British thennal unit (Btu) will raise 1 lb of water 1°F at 68°F 
1 calorie (cal) will raise one gram (g) of water 1°C at 20°C 
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APPENDIX D. LITERATURE REVIEW CODEBOOK 


100-Literature Source: 


101— Whole Book 

102— Book, Section 

103— Consumer Magazine 

104— Professional Journal: peer reviewed 

105— Trade Journal: fire service, building construction industry, architectural digest 

106— Website 

107— Conference Proceedings 

108— Other 

200-Year : Four-digit code for year document/article was published, (n.d., if no date 
provided) 

300— Geocoding: The document/article pertains to circumstances specific to the nation 
listed. 

301— Not specific to geographical location. 

302— Australia 

303— Canada 

304— China/Hong Kong/Taiwan 

305— Denmark 

306— Finland 

307— Japan 

308— New Zealand 

309— United Kingdom 

310— United States 

311— Other 

312— Unknown: not stated. 

Variables 


Ql. Arson was mentioned in same article as performance-based design. 

0. No 
1. Yes 

Q2 Perfonnance based design was identified as a design solution for arson mitigation 
(e.g., permanent countermeasures). 


0. No 
1. Yes 
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Q3 If used as an assessment method, the proposed perfonnance-based design solution 
was detennined to be: 

0. Not addressed/No assessment made 

1. Unsuitable 

2. Suitable 

3. Situation dependent 

Q4 If used as design method, keywords for the identified/needed facilitating criteria 
were: 

Q5 If used as a design method, keywords for the identified impediments to using 
perfonnance based design were: 

Q6 The SFPE Engineering Guide to Performance Based Fire Protection was 
mentioned in article in relation to arson mitigation. 

0. No 
1. Yes 

Q7 The International Code Council Performance Code for Buildings and Facilities 
was mentioned in article in relation to arson mitigation. 

0. No 
1. Yes 

Q8 The SFPE Engineering Guide to Performance Based Fire Protection was 
identified as an arson mitigation design method. 

0. No 
1. Yes 

Q9 The International Code Council Performance Code for Buildings and Facilities 
was identified as an arson mitigation design method. 

0. No 
1. Yes 

Q10 If used as a design method, the application of the SFPE Engineering Guide to 
Performance Based Fire Protection performance-based design solution was 
detennined to be: 
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0. Not addressed/No assessment made 

1. Unsuitable 

2. Suitable 

3. Situation dependent 


Qll If used as design method, keywords for the identified/needed facilitating criteria 
were: 

Q12 If used as a design method, keywords for the identified impediments to using 
perfonnance based design were: 

Q13 If used as a design method, the application of the International Code Council 
Performance Code for Buildings and Facilities performance-based design 
solution was detennined to be: 

0. Unsuitable 

1. Not addressed/No assessment made 

2. Suitable 

3. Situation dependent 

Q14 If used as design method, keywords for the identified/needed facilitating criteria 
were: 

Q15 If used as a design method, keywords for the identified impediments to using 
performance based design were: 
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